MITRE recently released its yearly list of the 2024 CWE Top 25 Most Dangerous Software Weaknesses.
This list differs from lists that contain the most common vulnerabilities, as it is not a list of vulnerabilities, but rather weaknesses in system design that can be exploited to leverage vulnerabilities.
“By definition, code injection is an attack, and when we think about the Top 25 it’s identifying the weaknesses underneath,” said Alec Summers, project leader for the CVE Program at MITRE.
These weaknesses can potentially pave the way for vulnerabilities and attacks, so it’s important to be aware of them and mitigate them as much as possible.
According to Summers, one trend in this year’s list is that while some weaknesses moved up or down the list, a lot of the weaknesses on the list are classic weaknesses that have been around for years, such as those that enable SQL injection and cross-site scripting.
“The more you understand these weaknesses, and you draw connections between these things, you can actually start to eliminate whole classes of problems that we see so many times,” he said.
Addressing these weaknesses not only improves product security, but also has the potential to save companies money because “the more weaknesses we avoid in product development, the less vulnerabilities to manage after deployment,” he explained.
This year’s list includes the following weaknesses:
- Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
- Out-of-bounds Write
- Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
- Cross-Site Request Forgery (CSRF)
- Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
- Out-of-bounds Read
- Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
- Use After Free
- Missing Authorization
- Unrestricted Upload of File with Dangerous Type
- Improper Control of Generation of Code (‘Code Injection’)
- Improper Input Validation
- Improper Neutralization of Special Elements used in a Command (‘Command Injection’)
- Improper Authentication
- Improper Privilege Management
- Deserialization of Untrusted Data
- Exposure of Sensitive Information to an Unauthorized Actor
- Incorrect Authorization
- Server-Side Request Forgery (SSRF)
- Improper Restriction of Operations within the Bounds of a Memory Buffer
- NULL Pointer Dereference
- Use of Hard-coded Credentials
- Integer Overflow or Wraparound
- Uncontrolled Resource Consumption
- Missing Authentication for Critical Function
The dataset the list is based on includes records for 31,779 Common Vulnerabilities and Exposures (CVEs) published between June 1, 2023 and June 1, 2024.
According to Summers, this year, the method in which the list was created was different than in past years because MITRE and CISA involved the broader security community to analyze the dataset, whereas in previous years MITRE’s Common Weakness Enumeration (CWE) team worked alone.
This may have resulted in many changes from previous years, and this year’s list only featured three weaknesses that retained the same ranking as last year: #3 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’), #10 Unrestricted Upload of File with Dangerous Type, and #19 Server-Side Request Forgery (SSRF).
The weaknesses that had the biggest upward move from last year’s list are #4 Cross-Site Request Forgery, which moved up five ranks; #11 Improper Control of Generation of Code (‘Code Injection’), which moved up 12 ranks; #15 Improper Privilege Management, which moved up seven ranks; and #18 Incorrect Authorization, which moved up six ranks.
Weaknesses that moved down in rank significantly include #12 Improper Input Validation, which moved down six ranks; #21 NULL Pointer Dereference, which moved down nine ranks; #23 Integer Overflow or Wraparound, which moved down nine ranks; and #25 Missing Authentication for Critical Function, which moved down five ranks.
This year also saw two new entries to the list and two entries that left the Top 25. New entries include #17 Exposure of Sensitive Information to an Unauthorized Actor and #24 Uncontrolled Resource Consumption. Previous entries no longer in the Top 25 are Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) and Incorrect Default Permissions.
According to MITRE, one possible cause of the changes is that they did not receive CWE mappings from the U.S. National Vulnerability Database analysts for the CVE records from the first half of 2024.
“It is not clear whether these gaps affect the relative rankings, since the distribution of unmapped CVEs seems likely to align roughly with the CWE distribution of the entire data set,” MITRE wrote.