Secure Electronic Commerce Vulnerabilities and Analysis

Overview of Vulnerabilities

  • Focus on vulnerabilities that affect secure electronic commerce.

  • Structured exploration of multiple types of vulnerabilities, their causes, examples, and implications.

Adding JavaScript to HTML Pages

Methods to Embed JavaScript

  1. Inline Code: Embed JavaScript within the HTML document using the <script> tag.

    • Example:
      html <html> <head> <title>page title</title> ¨K32K </head> <body> ¨K33K </body> </html>

  2. External JavaScript File: Utilize an external .js file referenced in the HTML document.

    • Example:
      html <html> <head> <title>page title</title> </head> <body> ¨K35K </body> </html> // Hello.js file function display() { alert("Hello World!"); }

Understanding Vulnerabilities

Why Do Vulnerabilities Happen?

  1. Knowledge Gap: Security professionals lack familiarity with the specific functionality of web applications.

    • Example Quote: "As a Network Security Professional, I don’t know how my company's web applications are supposed to work, so I spread a protective solution… but don’t know if it’s protecting what it’s supposed to.”

  2. Lack of Security Awareness in Development: Application developers often prioritize feature functionality over security.

    • Example Quote: "As an Application Developer, I can build great features and functions while meeting deadlines, but I don’t know how to develop my web application with security as a feature.”

Types of Vulnerabilities

1. Technical Vulnerabilities

  • Definition: Caused by insecure programming techniques.

  • Mitigation: Generally implemented through code changes; can be detected by automated scanners.

  • Example: Injection of malicious scripts, e.g., http://example/order.asp?item=<script>alert('p0wned')</script>&price=300.00.

2. Logical Vulnerabilities

  • Definition: Result from faulty program logic or poor trust decisions rather than source code errors.

  • Mitigation: Often requires architectural changes; detection is generally context-dependent and performed by human review.

  • Example: Manipulating item prices through URL alterations, such as http://example/order.asp?item=toaster&price=30.00.

Summary of Differences

  • Technical vulnerabilities relate directly to technical aspects of development, whereas logical vulnerabilities involve flawed application logic.

Examples of Vulnerabilities

Technical Vulnerabilities

  • Causes: Insecure development language, practices, or database structures.

  • SQL Injection: A common vulnerability where attackers exploit un-sanitized inputs to manipulate databases.

    • Illustration: An error revealing SQL or ODBC errors signifies potential exploitable weaknesses.

Logical Vulnerabilities

  • Definition: Occur when structural flaws exist in the web application's logic.

  • Ticket Purchase Scenario: Example URL http://concerts/final.asp?concertID=5&quantity=2&price=200.00 allows an attacker to manipulate the price to something lower, e.g., http://concerts/final.asp?concertID=5&quantity=2&price=1.00.

  • Outcome: The application accepts the reduced price, resulting in unauthorized discounts – a flaw that automated scanners cannot detect because they lack context understanding.

OWASP (Open Web Application Security Project)

Website: https://owasp.org/

  • Purpose: Not-for-profit organization aimed at improving software security.

  • Key Resource: The OWASP Top 10, a list published approximately every three years, highlighting the most critical web application security risks.

Latest OWASP Top 10 (2021)

  • Categorization of vulnerabilities changes to focus on the most critical aspects in evolving threat landscapes.

  • New categories introduced, with current merging and renaming of existing categories noted.

OWASP Top 10: 2025 List

  • Categories 1. Broken Access Control 2. Security Misconfiguration 3. Software Supply Chain Failures 4. Cryptographic Failures 5. Injection 6. Insecure Design 7. Authentication Failures 8. Software or Data Integrity Failures 9. Security Logging and Alerting Failures 10. Mishandling of Exceptional Conditions

Detailed Discussion of OWASP Top 10 Vulnerabilities

A01:2025 - Broken Access Control

  • Description: When an application does not properly restrict access, allowing users to access or modify unauthorized resources.

    • E-Commerce Scenario: URL manipulation, e.g., changing /order?id=1025 to /order?id=1026 where checks aren’t enforced.

    • Common Attack Type: Insecure Direct Object Reference (IDOR).

  • Secure Controls: Implement strict server-side authorization checks and role-based access control (RBAC).

    • Deny access by default (fail securely)

    • Avoid exposing predictable IDs

    • Log & monitor unauthorized access attempts

A02:2025 - Security Misconfiguration

  • Description: Occurs when systems or applications are improperly configured, leaving them vulnerable.

    • Examples: Open ports, default credentials, missing security headers.

  • Misconfiguration Impact: Allows unauthorized access or enables exploitation of the application’s weaknesses (e.g., through input injection).

  • Preventive Measures: Secure default configurations, validation of user inputs, and regular scanning for vulnerabilities.

A03:2025 - Software Supply Chain Failures

  • Description: Risks from dependencies on external components such as libraries and frameworks.

    • Example: Compromised libraries spread vulnerabilities across many applications.

  • Preventive Measures: Use of vetted sources for dependencies, regular updates, and integration of scans for known vulnerabilities.

A04:2025 - Cryptographic Failures

  • Description: Poor encryption practices leading to exposure of sensitive data.

    • Examples: Sending credentials over unencrypted HTTP, storing passwords as plain text.

  • Preventive Controls: Use HTTPS, encrypt sensitive data, and implement strong key management strategies.

A05:2025 - Injection

  • Description: Exploits that insert malicious input into commands or queries without proper validation.

    • Example: SQL injection allowing unauthorized data access.

  • Preventive Measures: Use parameterized queries, input validation, and appropriate user permissions.

A06:2025 - Insecure Design

  • Description: Structural flaws that introduce vulnerabilities, even if the code is functional.

    • Example: Poorly configured user roles leading to exploitation.

  • Preventive Controls: Adopting secure design patterns and thorough threat modeling during the development phase.

A07:2025 - Authentication Failures

  • Description: Inability to reliably verify user identities leading to unauthorized access.

    • Examples: Weak passwords, flawed session management.

  • Secure Controls: Enforcing strong password policies, rate limiting login attempts, and multi-factor authentication.

A08:2025 - Software or Data Integrity Failures

  • Description: Trusting unverified code or updates, leading to malicious changes in the application.

    • Example: Automatic updates from unverified sources.

  • Preventive Controls: Digital signatures for updates and verification of all components.

A09:2025 - Security Logging and Alerting Failures

  • Description: Failures in logging vital security events can allow prolonged undetected attacks.

    • Examples: Lack of alerts for abnormal activities.

  • Secure Controls: Implementing logging for critical actions and alerting for suspicious behaviors.

A10:2025 - Mishandling of Exceptional Conditions

  • Description: Inadequate handling of unexpected situations leading to security risks.

    • Example: Exposing internal logic in error messages.

  • Preventive Controls: Proper validation, safe messaging, and handling conventions during errors.

Common Thread in OWASP Vulnerabilities

  • Dynamic code or user inputs are significant sources of vulnerabilities, necessitating rigorous testing and security awareness in the design phase.

  • Emphasis on proactive security measures that integrate seamlessly into the development process rather than retrofitting security measures post-development.

National Vulnerabilities Database

  • Website: https://nvd.nist.gov

    • Function: Provides a comprehensive database of cybersecurity vulnerabilities, integrating U.S. government resources, and structured according to the CVE naming standard.

    • Common Vulnerabilities and Exposures (CVE): A system for identifying vulnerabilities unique reference numbers for easier tracking and remediation.