Web app attacks target security misconfigurations

New research from Barracuda finds that 30 percent of all attacks against web applications target security misconfigurations -- such as coding and implementation errors.

Analysis of incidents detected and mitigated by Barracuda Application Security during December shows 21 percent involved code injection. Though these were more than just SQL injections, generally designed to steal, destroy, or manipulate data.

Log4Shell and LDAP injection attacks were also popular. LDAP is used by organizations for privilege management, resource management, and access control, for example to support single sign on (SSO) for applications.

Anti-botnet detection data shows that the majority (53 percent) of bot attacks targeting web
applications in December 2023 were volumetric distributed denial of service (DDoS) attacks. This type of brute force attack can often be used as cover for a more targeted attack against a network.

The data also shows that around a third (34 percent) of bot attacks were application DDoS attacks, targeting a specific application, and five percent were bot-driven account takeover attempts.

Outdated and vulnerable components in applications continue to be a focus for attacks. The
ProxyShell vulnerabilities complex from 2021, for example, has been continuously exploited, leading to a number of high-profile breaches, including ransomware.

Tushar Richabadas, senior product marketing manager, applications and cloud security at Barracuda, writes on the company’s blog:

Defenders are hard pressed to keep up with the growing number of vulnerabilities. They have to contend with both zero-days and older vulnerabilities. The software supply chain for critical apps may also have vulnerabilities -- as demonstrated by the Log4Shell vulnerability.

Attackers will often target old vulnerabilities that security teams have forgotten about to try and breach an overlooked, unpatched application and then spread into the network.

You can read more on the Barracuda blog.

Image credit: PopNukoonrat/Dreamstime.com