🛡️ CWE/SANS Top 25 Most Dangerous Software Weaknesses

💥 Impact

Remote Code Execution (RCE), system compromise, denial of service

🌍 Real-World Examples

CVE-2021-21220 (Chrome V8), CVE-2021-34527 (PrintNightmare), numerous IoT firmware vulnerabilities

🛡️ Prevention

• Use memory-safe languages (Rust, Go, Java)
• Bounds checking on all buffer operations
• ASLR + DEP/NX enabled
• Use safe string functions (strncpy vs strcpy)
• Compiler hardening flags (-fstack-protector, -D_FORTIFY_SOURCE)

🔎 Detection

• AddressSanitizer (ASan) in testing
• Fuzzing (AFL, libFuzzer)
• SAST tools (Coverity, CodeQL)
• Runtime memory error detection

💥 Impact

Session hijacking, credential theft, defacement, malware distribution, phishing

🌍 Real-World Examples

CVE-2020-11022 (jQuery), persistent XSS in WordPress plugins, Stored XSS in Jira (CVE-2022-36804)

🛡️ Prevention

• Output encoding for the correct context (HTML, JS, URL, CSS)
• Content Security Policy (CSP) headers
• Use frameworks with auto-escaping (React, Angular)
• DOM-based XSS prevention with safe APIs
• HTTPOnly and Secure cookie flags

🔎 Detection

• DAST scanners (Burp Suite, OWASP ZAP)
• Browser security testing
• WAF rules for XSS patterns
• Code review for raw HTML output

💥 Impact

Full database compromise, data exfiltration, authentication bypass, remote code execution via xp_cmdshell

🌍 Real-World Examples

CVE-2019-3396 (Confluence), MOVEit Transfer (CVE-2023-34362), countless web application breaches

🛡️ Prevention

• Parameterized queries / prepared statements (ALWAYS)
• ORM frameworks (Hibernate, SQLAlchemy, Prisma)
• Input validation with allowlists
• Least privilege database accounts
• Stored procedures with parameterized inputs

🔎 Detection

• SAST for concatenated SQL strings
• DAST/SQLMap testing
• WAF with SQL injection signatures
• Database activity monitoring (DAM)
• Anomalous query pattern detection

💥 Impact

Remote code execution, privilege escalation, system compromise

🌍 Real-World Examples

CVE-2022-22047 (Windows CSRSS), CVE-2021-21224 (Chrome V8), numerous browser and kernel exploits

🛡️ Prevention

• Use memory-safe languages (Rust ownership model)
• Smart pointers (unique_ptr, shared_ptr in C++)
• Set pointers to NULL after free
• RAII pattern for resource management
• Memory tagging (MTE on ARM)

🔎 Detection

• ASan (AddressSanitizer)
• Valgrind memcheck
• Fuzzing with sanitizers
• Static analysis for dangling pointer patterns

💥 Impact

Full system compromise, data exfiltration, lateral movement, ransomware deployment

🌍 Real-World Examples

CVE-2021-44228 (Log4Shell enabled command injection), Fortinet FortiOS (CVE-2022-42475), network device RCE vulnerabilities

🛡️ Prevention

• Avoid OS commands — use language-native APIs
• If unavoidable, use allowlisted parameters only
• Never pass user input to shell functions
• Sandboxing / containerization
• Remove shell metacharacter interpretation

🔎 Detection

• SAST for system(), exec(), popen() with user input
• Runtime application self-protection (RASP)
• Command-line auditing on servers
• WAF rules for command injection patterns

💥 Impact

Enables many other vulnerability classes — injection, buffer overflow, logic bypasses

🌍 Real-World Examples

Underpins most OWASP Top 10 vulnerabilities, API abuse scenarios, business logic flaws

🛡️ Prevention

• Validate all inputs server-side (never trust client)
• Allowlist validation over denylist
• Validate data type, length, range, and format
• Reject unexpected input rather than sanitizing
• Schema validation for API inputs (JSON Schema, OpenAPI)

🔎 Detection

• SAST for missing validation patterns
• Fuzzing to discover edge cases
• API testing with malformed inputs
• Runtime monitoring for anomalous input patterns

💥 Impact

Information disclosure (memory contents, keys, credentials), crash/DoS, bypass of ASLR

🌍 Real-World Examples

CVE-2014-0160 (Heartbleed — OpenSSL), CVE-2020-0601 (CurveBall), numerous image parser vulnerabilities

🛡️ Prevention

• Bounds checking on all array/buffer access
• Memory-safe languages
• Safe standard library functions
• Compiler-based bounds checking
• Fuzzing with ASan

🔎 Detection

• ASan/MSan in testing
• Fuzzing (especially protocol and file parsers)
• SAST for unchecked buffer access
• Valgrind

💥 Impact

Read/write arbitrary files, source code disclosure, credential theft, remote code execution

🌍 Real-World Examples

CVE-2021-41773 (Apache HTTP Server), CVE-2023-22527 (Confluence), Zip Slip vulnerabilities

🛡️ Prevention

• Use a chroot/jail or sandbox for file operations
• Canonicalize paths then verify against allowlist
• Never use raw user input in file paths
• Restrict file access to designated directories
• Use platform-specific path APIs (Path.normalize())

🔎 Detection

• SAST for file operations with user input
• DAST with path traversal payloads
• WAF rules for ../ sequences
• File access monitoring for unexpected locations

💥 Impact

Unauthorized state changes — password changes, fund transfers, account modifications

🌍 Real-World Examples

CVE-2019-11869 (WordPress plugins), banking CSRF attacks, social media account takeover

🛡️ Prevention

• Anti-CSRF tokens (synchronizer token pattern)
• SameSite cookie attribute (Strict or Lax)
• Double-submit cookie pattern
• Verify Origin/Referer headers
• Re-authentication for sensitive actions

🔎 Detection

• DAST scanners (check for missing CSRF tokens)
• Code review for state-changing GET requests
• Penetration testing
• Monitor for unexpected cross-origin requests

💥 Impact

Remote code execution via web shell, server compromise, malware distribution

🌍 Real-World Examples

CVE-2023-27997 (FortiGate), web shell deployment in IIS/Apache, ransomware delivery via upload forms

🛡️ Prevention

• Validate file type by content (magic bytes), not just extension
• Store uploads outside web root or in object storage
• Rename uploaded files with random names
• Set Content-Disposition: attachment for downloads
• Scan uploads with antivirus/sandbox
• Restrict file size and allowed extensions

🔎 Detection

• File integrity monitoring on upload directories
• Antivirus/sandbox scanning of uploads
• WAF rules for web shell patterns
• Monitor for new executable files in web directories

💥 Impact

Horizontal/vertical privilege escalation, unauthorized data access, IDOR vulnerabilities

🌍 Real-World Examples

Broken Object Level Authorization (BOLA) — OWASP API #1, numerous API data breaches, IDOR in social media platforms

🛡️ Prevention

• Enforce authorization on every request server-side
• Use RBAC or ABAC frameworks
• Deny by default — require explicit grants
• Centralized authorization middleware
• Never expose internal IDs — use UUIDs or indirection

🔎 Detection

• Automated API testing for IDOR
• Access log analysis for privilege escalation patterns
• Forced browsing tests
• Penetration testing with different privilege levels

💥 Impact

Denial of service (crash), potential code execution in kernel mode

🌍 Real-World Examples

CVE-2021-3156 (Sudo Baron Samedit), numerous kernel NULL deref vulnerabilities, embedded system crashes

🛡️ Prevention

• Check pointers before use
• Use Option/Maybe types (Rust, Haskell, Kotlin)
• Enable compiler warnings for NULL usage
• Static analysis for NULL paths
• Defensive programming patterns

🔎 Detection

• SAST for unchecked NULL returns
• Fuzzing
• Code review focusing on error paths
• Runtime crash monitoring

💥 Impact

Privilege escalation, unauthorized data access, business logic bypass

🌍 Real-World Examples

Broken Function Level Authorization (OWASP API #5), admin panel access, role confusion bugs

🛡️ Prevention

• Centralized, well-tested authorization logic
• Unit test all authorization paths
• Principle of least privilege
• Separate admin and user APIs/routes
• Regular authorization audits

🔎 Detection

• Penetration testing with role-based scenarios
• Automated RBAC testing frameworks
• Code review of authorization logic
• Access log analysis for anomalous patterns

💥 Impact

Buffer overflow, incorrect calculations, bypass of security checks, denial of service

🌍 Real-World Examples

CVE-2021-3156 (Sudo heap overflow via integer overflow), CVE-2014-1266 (Apple goto fail), embedded system vulnerabilities

🛡️ Prevention

• Use safe integer arithmetic libraries
• Check for overflow before operations
• Use types with guaranteed sizes
• Compiler flags for integer overflow detection
• Language-level overflow protection (Rust panics on overflow in debug)

🔎 Detection

• SAST for unchecked arithmetic
• UBSan (UndefinedBehaviorSanitizer)
• Fuzzing with boundary values
• Code review for size calculations

💥 Impact

Arbitrary command execution, full system compromise, data exfiltration

🌍 Real-World Examples

CVE-2021-25296 (Nagios XI), IoT device command injection, CI/CD pipeline injection

🛡️ Prevention

• Use parameterized interfaces instead of shell commands
• Strict allowlist validation
• Avoid command interpreters (shell=false)
• Input encoding/escaping
• Principle of least privilege for application processes

🔎 Detection

• SAST for command construction with user input
• DAST with command injection payloads
• Command-line audit logging
• Behavioral monitoring for unexpected child processes

💥 Impact

Code execution, information disclosure, denial of service

🌍 Real-World Examples

Parent category — encompasses CWE-787, CWE-125, CWE-120, and many CVEs targeting C/C++ applications

🛡️ Prevention

• Memory-safe languages for new development
• Bounds-checking wrappers for C/C++
• Stack canaries and ASLR
• Safe coding standards (CERT C, MISRA)
• Compiler hardening options

🔎 Detection

• ASan/MSan/TSan sanitizers
• Fuzzing
• Static analysis suites
• Binary analysis tools (IDA Pro, Ghidra)

💥 Impact

Authentication bypass, full system access, supply chain compromise when credentials shared across deployments

🌍 Real-World Examples

CVE-2021-36260 (Hikvision cameras), CVE-2020-29583 (Zyxel firewalls), numerous IoT device backdoors

🛡️ Prevention

• Never hard-code credentials in source code
• Use secrets management (Vault, AWS Secrets Manager, Azure Key Vault)
• Environment variables or config files outside repo
• Pre-commit hooks to detect secrets (git-secrets, truffleHog)
• Rotate credentials regularly

🔎 Detection

• Secret scanning in CI/CD (GitHub secret scanning, GitLeaks)
• SAST rules for credential patterns
• Binary analysis for embedded strings
• Pre-commit hooks

💥 Impact

Internal network scanning, cloud metadata theft (IMDS), access to internal APIs, RCE via internal services

🌍 Real-World Examples

Capital One breach (2019, AWS IMDS via SSRF), CVE-2021-26855 (Exchange ProxyLogon chain), Jira/Confluence SSRF

🛡️ Prevention

• Allowlist permitted domains/IPs/protocols
• Block requests to private IP ranges (10.x, 172.16.x, 169.254.x)
• Disable URL redirects in HTTP clients
• Use IMDSv2 (requires token for cloud metadata)
• Network-level egress filtering from application tier

🔎 Detection

• WAF rules for internal IP patterns in URL parameters
• Monitor outbound connections from web servers
• DAST with SSRF payloads
• Cloud metadata access logging

💥 Impact

Unauthorized access to admin functions, data manipulation, system compromise

🌍 Real-World Examples

CVE-2021-26084 (Confluence unauthenticated RCE), exposed admin panels, unprotected API endpoints

🛡️ Prevention

• Authentication required for all non-public endpoints
• Centralized authentication middleware
• Default-deny authentication policy
• Regular endpoint auditing
• API gateway enforcement

🔎 Detection

• Endpoint inventory and authentication audit
• Forced browsing/directory enumeration testing
• Penetration testing for unauthenticated access
• API specification review

💥 Impact

Privilege escalation, authentication bypass, file system manipulation, double-spend in financial applications

🌍 Real-World Examples

CVE-2016-5195 (Dirty COW — Linux kernel), symlink race attacks, financial double-spend bugs

🛡️ Prevention

• Atomic operations for check-then-use patterns
• File locking and mutex/semaphore usage
• Use file descriptors instead of filenames after check
• Database transactions with proper isolation levels
• Avoid shared mutable state

🔎 Detection

• Thread sanitizer (TSan)
• Concurrency-aware static analysis
• Race condition fuzzing
• Code review focused on shared state

💥 Impact

Remote code execution, denial of service, authentication bypass, object manipulation

🌍 Real-World Examples

CVE-2017-9805 (Apache Struts), CVE-2019-2725 (Oracle WebLogic), Java deserialization attacks (ysoserial)

🛡️ Prevention

• Avoid deserializing untrusted data entirely
• Use safe formats (JSON, protobuf) instead of native serialization
• Implement integrity checks (HMAC) on serialized data
• Allowlist permitted classes for deserialization
• Use look-ahead deserialization with ObjectInputFilter (Java)

🔎 Detection

• SAST for deserialization of external input
• Runtime monitoring for deserialization gadget chains
• WAF rules for serialized object patterns
• DAST with deserialization payloads (ysoserial)

💥 Impact

Privilege escalation, unauthorized system access, blast radius amplification

🌍 Real-World Examples

CVE-2021-1732 (Windows Win32k privilege escalation), overprivileged cloud IAM roles, container breakout via excessive capabilities

🛡️ Prevention

• Principle of least privilege — always
• Drop privileges after initialization
• Separate privileged and unprivileged components
• Regular privilege audits
• Use capability-based security (Linux capabilities vs full root)

🔎 Detection

• IAM policy analysis (AWS Access Analyzer, Azure Advisor)
• Monitor for privilege escalation events
• Container security scanning for excessive capabilities
• Regular access rights review

💥 Impact

Credential exposure, PII disclosure, system architecture revelation aiding further attacks

🌍 Real-World Examples

Stack traces in production, verbose API error messages, exposed .env files, debug endpoints left enabled

🛡️ Prevention

• Generic error messages in production
• Structured logging without sensitive data
• Remove debug endpoints before deployment
• Redact PII/credentials in logs
• Proper HTTP response headers (no Server, X-Powered-By)

🔎 Detection

• DAST for information disclosure
• Log review for sensitive data exposure
• Configuration auditing
• Secret scanning in logs and responses

💥 Impact

Denial of service, resource starvation affecting other applications, increased cloud costs

🌍 Real-World Examples

ReDoS (Regular Expression DoS), CVE-2018-6389 (WordPress DoS), ZIP bomb attacks, billion laughs (XML)

🛡️ Prevention

• Rate limiting and throttling
• Set resource limits (memory, CPU, file descriptors)
• Limit request sizes and timeouts
• Use non-backtracking reget engines
• Resource quotas in cloud/container environments

🔎 Detection

• Performance monitoring and alerting
• Rate limit monitoring
• Resource usage anomaly detection
• Load testing and stress testing

💥 Impact

Local privilege escalation, unauthorized data access, credential exposure via world-readable config files

🌍 Real-World Examples

Docker socket world-readable (container escape), cloud storage buckets publicly accessible, /etc/shadow permissions misconfigured

🛡️ Prevention

• Set restrictive default permissions (umask 077)
• Follow principle of least privilege for files
• Audit permissions during CI/CD
• Infrastructure as Code with explicit permissions
• CIS Benchmarks for OS hardening

🔎 Detection

• File permission auditing tools
• CIS benchmark scanning
• Cloud posture management (CSPM)
• Configuration compliance monitoring