An Analysis and Classification of Vulnerabilities in

Web-Based Application Development

Shekhar Disawal Ugrasen Suman
School of Computer Science & IT School of Computer Science & IT
Devi Ahilya University Devi Ahilya University
Indore, M.P., India Indore, M.P., India
2021 8th International Conference on Computing for Sustainable Global Development (INDIACom) | 978-93-80544-43-4/21/$31.00 ©202110.1109/INDIACom51348.2021.00140

[email protected] [email protected]

Abstract—Nowadays, web vulnerability is a critical issue in web web application vulnerability report, 46% of the web have
applications. Web developers develop web applications, but high, and 86% of websites have medium security
sometimes they are not very well-versed with security concerns, vulnerability [3]. It becomes significant to assess the
thereby creating loopholes for the vulnerabilities. If a web vulnerability of a web application before it deploys on the
application is developed without considering security, it is internet. A definite format or strategy needs to be employed
harmful for the client and the company. Different types of by organizations with complete safety and assurance to
vulnerabilities encounter during the web application reduce the risk.
development process. Therefore, vulnerability identification is a
crucial and critical task from a web application development The solution for ensuring security issues is to identify the
perspective. It is vigorous to secure them from the earliest probable fragile areas of the web application. Mitigation
development life cycle process. In this paper, we have analyzed techniques should be practically used in areas where many
and classified vulnerabilities related to web application security vulnerabilities arise, as monetary and time constraints are
during the development phases. Here, the concern is to identify also crucial. The root causes of the weaknesses can be
a weakness, countermeasure, confidentiality impact, access recognized with the help of vulnerability classification.
complexity, and severity level, which affect the web application Vulnerabilities have similar properties and available
security. features, such as causes, effects, locations [4].
Keywords—Web application vulnerability; Vulnerability Vulnerabilities are classified according to severity levels,
classification; Taxonomy; Web application security. such as high, medium, and low. The impact of the
vulnerability is different according to severity level. The
I. INTRODUCTION high severity level is more insecure for the web application.
Web services play a prominent role and are an integral Arranging vulnerabilities according to severity level and
part of our life. It may be education, banking, and other web categorizing them can be useful to design an ideal security
applications. The availability and simplicity of web-based solution. An appropriate vulnerability classification scheme
applications have attracted people to use it; on the other plays an important role in increasing vulnerability coverage
hand, security concerns are still unaddressed. Organizations [5]. The vulnerability classification describes the
try to maintain secrecy, probity, and authenticity as all these categorization of vulnerabilities in a proper structure to
factors help to maintain a competitive edge and practicability achieve generalization [6].
[1].
There are many different types of vulnerability databases
Web-related applications are open to all web users, available, which provide a list of known vulnerabilities. The
irrespective of whether they are genuine or malicious. There task of a database is to collect and maintain different values
is always a threat of cyber-attacks looming large. The and abilities that store vulnerabilities and characterize them
fundamental nature of web-related applications and their by numerous characteristics. These databases help to provide
interconnectivity enables it easier for hackers to access the up to date collection of vulnerability data helpful for
information of users and organizations and their personal research. Some of the widely used databases are National
data. Today web applications are an easy and prime target Vulnerability Database (NVD) [7], The Open Source
for hackers to gain financial benefit [2]. Vulnerability Database (OSVDB) [8], Common
Vulnerability Enumeration (CWE) [9], and The Open Web
Web application vulnerabilities are the primary goal for Application Security Project (OWASP), is a foundation that
hackers. Notorious minds manipulate and use these flaws works for security. It provides the Top Ten recent critical
and loopholes to capture data and inject malicious codes into web application vulnerabilities [10]. The different database
internal systems. Vulnerability is a weakness or error in an uses different classification schemes, but there is a lack of
application at the time of design and coding that can allow the standard classification scheme.
an attacker to exploit our web application. Some common
web vulnerabilities examples are SQL injection, cross-site In software development, fault identification plays a
scripting flaws, security misconfiguration, and broken crucial role for the successful operation of software and its
access. development. It may help the developer save time, cost, and
effort at the development phase [11]. To secure web
There are innumerous web applications available on the application, vulnerability must be checked from the initial
internet which are highly unsafe. According to acunetix 2019

978-93-80544-43-4/21/$31.00 2021
c IEEE 782

Authorized licensed use limited to: Tunku Abdul Rahman University College. Downloaded on March 09,2022 at 07:27:18 UTC from IEEE Xplore. Restrictions apply.
 stage to the final stage. Early detection of vulnerability is the Cross-site request forgery is an assault requiring a victim
best option for the security team to detect, block, and to send an HTTP request to a target endpoint without their
mitigate during every development life cycle phase. Security consent or intent to behave as a victim. The underlying cause
of web applications is the most crucial concern. Developers is application functionality using predictable URL/ Form
must care about quality attributes at the development phase actions in a repeatable way. Information leakage
[12]. vulnerability occurs when a web site discloses sensitive data,
such as developer remarks or error messages display, which
In this paper, we have analyzed and classified may support an attacker in exploiting the system. The
vulnerabilities related to web application security during the
insufficient authentication attack permits hackers to access
development phases. Here, the concern is to identify a personal and sensitive features of web applications without
weakness, countermeasure, confidentiality impact, access authenticating correctly [13].
complexity, and severity level affecting web application
security. C. Implementation Phase
Section II describes the classification of web The implementation phase is based on the success of the
vulnerability according to different phases of the life cycle, design phase. In this phase, the developer starts the
section III is the discussion part, and section IV concludes implementation process according to design. The
that how we can improve the security of web applications at vulnerability occurs due to bad design decisions and poor
the development phase. coding. There are eight types of such vulnerabilities; buffer
overflow, content spoofing, credential/session prediction,
II. CLASSIFICATION OF WEB APPLICATION VULNERABILITIES cross-site scripting, denial of service, injecting operating
The web application vulnerability is classified according system command, path traversal, and SQL injection. A
to the different development phases of the life cycle. buffer is used to store and transfer data from one location to
another. If the storage capacity of memory is over-limit, then
A. Requirement Analysis a buffer overflow attack occurred. The attacker sends new
The requirement analysis phase is understanding and instruction, destroy files, and modify the execution path.
defining what resources are expected from the system and Content Spoofing is an attack tactic that enables an
defining restrictions on the implementation and growth. It is attacker to insert a malicious payload that is then distorted as
a critical stage of the development process as errors certainly web applications genuine content. Credential/session
lead to later problems in the application design and prediction is a means of hijacking or impersonating a user of
implementation. During the requirement analysis, if web a website. Deducting or guessing a particular attribute that
requirement is not appropriately analyzed and security is not distinguishes a single session or individual executes an
taken care, vulnerabilities are expected to occur. There exist attack.
three vulnerabilities, i.e., broken access control, abuse of
functionality, and improper error handling attacks in this Cross-site scripting is a widespread web vulnerability
phase. In a broken access control attack, the criminal attack for web applications. If a web application accepts a
conducts unwanted activities. If the access control is not malicious input script through the application, it is due to a
mentioned correctly in the application, the attacker can act cross-site scripting attack. Denial of service (DoS) is an
outside of the limit. It can misuse information, modifies the attack tactic intended to block a website from serving usual
data in websites, or destroys data. If an unauthorized user user behavior. DoS attacks, which are easily generally
can access the admin page, it means an access control flaw. applied to the network layer, are also possible at the
application layer. Injecting operating system commands
Abuse of functionality is an attack method that uses through the application is the source of command injection
website features and functions to attack itself or others. attacks. The path traversal attack technique lets attackers
Abuse of functionality is an application’s expected access directories and commands that potentially reside in
functionality to achieve an unwanted result. The probability the web documents source directory.
and level of exploitation vary from web site to web site and
application to application. Improper error handling attack SQL injection vulnerability allows attackers to access
occurs when web applications share an access amount of and modify the database information and other sensitive
information to their users. Sensitive information might be data, such as banking information and other personal
revealed due to this [13]. information. It allows an attacker to delete and update the
database's record by manipulating SQL command logic [13].
B. Design Phase
The design phase interprets requirements into an D. Deployment Phase
illustration of the application that can be evaluated for Vulnerabilities at the deployment phase occur due to
quality before coding begins. It is documented and becomes flaws that are likely to be implemented because of lousy
a part of the application configuration. In this phase, implementation practices or standard application
vulnerability occurs due to poorly defined designs or lack of configurations. Three vulnerabilities are identified at this
security checks in the web design. Four vulnerabilities are phase, i.e., insufficient session expiration, application
identified in this phase; brute force, cross-site request misconfiguration, and session fixation. Insufficient session
forgery, information leakage, and insufficient authentication. expiration occurs when an intruder can recycle old session
Brute force vulnerability is used to monitor an unknown IDs for a web application authorization. Insufficient session
value using an automatic method to evaluate different expiration increases web application exposure to attacks that
characteristics. In that, attackers can modify privilege and steal or reprocess user session identifiers. Application
crack the password. misconfiguration vulnerability exploits web application if

2021 8th International Conference on Computing for Sustainable Global Development (INDIACom 2021) 783

Authorized licensed use limited to: Tunku Abdul Rahman University College. Downloaded on March 09,2022 at 07:27:18 UTC from IEEE Xplore. Restrictions apply.
 weakness is found in configuration related. Session fixation medium, and high. The source of attack represents the attack
is an attack strategy that drives the user session ID to an pattern local or remote. Severity level provides the ranking
explicit value [13]. to vulnerability attack. We use NVD ranks vulnerabilities
scores CVSS v3.0 ranges 0.0, 0.1-3.9, 4.0-6.9, 7.0-8.9, and
We have analyzed different web vulnerability impacts in 9.0-10.0 by assigning one out of five severity levels for
development phases with confidentiality impact, access None, Low, Medium, High, and Critical [7].
complexity, source of the attack, and severity level.
Confidentiality impact examines the effect of regulating In Table I, we have found that many web application
access and disclosure of information to unauthorized users vulnerabilities occur in different web development phases.
on confidentiality. Impact measure values are complete, We have analyzed different web vulnerability impacts in
partial, and none. Access complexity tests the difficulty of development phases concerning confidentiality impact,
the attack needed to exploit the vulnerability to access the access complexity, source of the attack, and severity level
application. The comparison metric values are small, [7-9][13].
TABLE I. CATEGORIZATION OF VULNERABILITIES

Classification Phases Vulnerability Confidentiality Impact Access Complexity Source of attack Severity level

Requirement Analysis Broken Access Control Complete Low Remote Critical

Abuse of Functionality None Medium Remote Low
Improper Error Handling Partial Low Remote Medium
Attacks
Design Brute Force Partial Low Remote Medium
Cross-Site Request Forgery Partial Medium Remote Medium
Information Leakage Partial Medium Remote Medium
Insufficient Authentication Complete Low Remote High
Implementation Buffer Overflow Complete Low Remote Critical
Content Spoofing None Medium Remote Medium
Credential/ Session Prediction None Low Remote Medium
Cross-Site Scripting None Medium Remote Medium
Denial of Service None Low Remote Medium
Injecting OS Command Partial Low Remote High
Path Traversal None Low Remote Medium
SQL Injections Complete Low Remote Critical
Deployment Insufficient Session Expiration Partial Medium Remote Medium
Application Miscon- Partial Low Remote Medium
figuration
Session Partial Low Remote High
Fixation

III. DISCUSSION At the implementation phase, two crucial vulnerabilities

From Table I, we have analyzed that in the requirement buffer overflow and SQL injection are identified. Both have
analysis phase, different vulnerabilities occur, but the broken a severe impact on the implementation phase. Buffer
access control vulnerability has the highest severity level, overflow can exploit targeted web application and modify its
and the confidentiality impact also very high. During the content. SQL injection can inject the backend database, and
analysis phase, the developer should be aware of this the attacker takes advantage of the loophole. During
vulnerability, and if it occurs, the proper measures should be implementation, developers should keep a security
taken to mitigate this type of vulnerability, so its impact can perspective in mind. Three vulnerabilities have identified
be minimized. Improper error handling attack has the insufficient session expiration, application misconfiguration,
medium severity level, and the confidentiality impact has and session fixation at the deployment phase. The severity
partial. The access complexity level is better from broken level of session fixation is the highest, and access complexity
access. The abuse of functionality vulnerability has none is very low. Because of this, the details are revealed to the
impact on security. We have identified that insufficient hacker. Lastly, if the developer takes care of security in early
authentication vulnerability is critical for the design phase development phases, then the probability of occurrence of
because of a high severity level and affects the vulnerability becomes very low at the deployment phase.
confidentiality of web applications completely at the design IV. CONCLUSION
level. If appropriate measures are taken during the beginning
of the design phase, the impact of vulnerabilities and related Security issues are rarely discussed in the time of web
risks can be reduced. Also, brute force, cross-site request development; also, it is a particular milestone. It should
forgery, and information leakage are similar in the analysis. begin at application inception and be on every developer's
They may be harmful to clients and the organization. mind during requirements analysis, design, implementation,

784 2021 8th International Conference on Computing for Sustainable Global Development (INDIACom 2021)

Authorized licensed use limited to: Tunku Abdul Rahman University College. Downloaded on March 09,2022 at 07:27:18 UTC from IEEE Xplore. Restrictions apply.
 and deployment. This is the only way that protection can be
consistently enhanced in any web product. Here, we have
observed that many web application vulnerabilities can be
removed at the requirement analysis phase, so the system
analyst provides correct and accurate information to the
developer. Similarly, at the design level of web-based
applications, if we have proper fields and records, we can
avoid maximum vulnerabilities at this level.
At the implementation stage, we have found that many
vulnerabilities are occurred due to improper implementation
of mitigation techniques in the previous phases. Due to this,
end-users security is at stake, which directly impacts the
reputation of the organizations. According to web
development phases, we have provided vulnerability
classification, which arranges and generalizes web
vulnerabilities in a well-defined structure, and weaknesses
can be identified in different phases. This classification helps
the web developers and the organization take appropriate
measures to mitigate the vulnerabilities at the initial web
development phase. Therefore, practitioners need to be
vigilant about security at all phases of web development.
Future work can be done in the direction to prevent and
mitigate web vulnerabilities at the earliest. We can design a
secure framework for developers and organizations.
REFERENCES
[1] F. K. Andoh-Baidoo, “Explaining investors’ reaction to internet
security”, International Journal Electronic Finance, Vol. 7, No. 1,
2013.
[2] V. Felmetsger, L. Cavedon, C. Kruegel, and G. Vigna, “Toward
automated detection of logic vulnerabilities in web applications”, In
proc. of the 19th USENIX conference on security, Washington, DC,
August 11 - 13, 2010, pp. 10-10.
[3] Acunetix, “Web Application Vulnerability Report”,
https://www.acunetix.com/acunetix-web- application-vulnerability-
report/, 2019.
[4] Z. Chen, Y. Zhang, and Z. Chen, “A categorization framework for
common vulnerabilities and exposures”, In the computer journal
advance access published online, May 7, 2009.
[5] O. Alhazmi, S. W. Woo, and Y. Malaiya, “Security vulnerability
categories in major software systems”, In proc. of the third IASTED
international conference on communication, network, and information
security, Cambridge, MA, USA, 2006.
[6] T. Aslam, I. Krsul, and E. H. Spafford, “Use of a taxonomy of security
faults”, In proc. of the 19th national information systems security
Conf., Baltimore, USA., 1996, pp. 551– 560.
[7] Govt. of USA, “National Vulnerability Database (NVD)”,
https://nvd.nist.gov/.
[8] J. Kouhns, “Open Source Vulnerability Database (OSVDB)”,
http://osvdb.org/.
[9] Mitre, ”Common Vulnerability Enumeration (CWE)”,
https://cwe.mitre.org/.
[10] OWASP (Open Web Application Security Project), “The Top 10 Most
Critical Web Application Security Risks”, https://owasp.org/www-
project-top-ten/, 2017.
[11] D. Sharma and P. Chandra, “A comparative analysis of soft computing
techniques in software fault prediction model development”,
Internation journals of information technology (BJIT), July 10, 2018.
[12] N. Pathak, B. M. Singh and G. Sharma, “UML 2.0 based framework
for the development of secure web application”, Internation journals of
information technology (BJIT), pp. 101-109, February 22, 2017.
[13] R. Auger, “Web Application Security Consortium version 2.0.0”,
http://www.webappsec.org/.

2021 8th International Conference on Computing for Sustainable Global Development (INDIACom 2021) 785

Authorized licensed use limited to: Tunku Abdul Rahman University College. Downloaded on March 09,2022 at 07:27:18 UTC from IEEE Xplore. Restrictions apply.