Cross-Site Scripting the Top Security Risk

Web administrators beware: Cross-site scripting vulnerabilities are now far more attactive targets than more notorious bugs such as buffer overflows, according to new figures from Mitre, a U.S. government-funded research organization.

Buffer overflows have long been one of the most common types of bugs attacked by malware, with Intel and Advanced Micro Devices (AMD) even building in hardware support for an antibuffer overflow technology called No Execute (NX) or Execution Disable (XD).

But a shift is under way, according to Mitre’s findings. While buffer overflows affect executable files written in languages such as C, the increasing popularity of cross-site scripting (XSS) bugs indicates attackers are looking more at programming languages typically used for Web applications, such as Java, .Net and PHP.

Client-side scripting languages generally include same-origin policies, which allow interaction between Web objects and pages only as long as they come from the same domain and over the same protocol. XSS bugs allow malicious websites to find ways around these policies, potentially accessing sensitive data in other objects or browser windows.

The second most popular type of attack was SQL injection, which allows attackers to execute malicious SQL statements within a database. Third most popluar were PHP “include” vulnerabilities, which can allow attackers to execute arbitrary script on a server by including them in an existing script.

Out of about 20,000 reported vulnerabilities recorded by Mitre so far this year, 21.5 percent were XSS, 14 percent were SQL injection, and 9.5 percent were PHP includes. Buffer overflows came in fourth at 7.9 percent.

Mitre first discussed the findings on Wednesday at the Cyber Security Executive Conference in New York, according to a report from industry journal Dark Reading.

-Matthew Broersma, Techworld.com (London)

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.