OWASP Top-10 2021 list with examples.

The OWASP Top 10 is a highly respected guide that identifies the most critical web application security risks. Published by the Open Web Application Security Project (OWASP), this list serves as a benchmark for security professionals and developers to design, build, and maintain secure software. Its relevance is magnified during technical due diligence, a process often employed by investors, venture capitalists, or acquirers to assess the technical health and security posture of a company.

The OWASP Top 10 Overview

The OWASP Top 10 is regularly updated to reflect the changing landscape of web application security. The latest edition emphasizes modern threats, providing a roadmap to counter vulnerabilities that can lead to data breaches, service disruptions, or regulatory non-compliance. Below are the 10 risks identified in the 2021 OWASP Top 10, along with their identifiers:

Broken Access Control (OWASP 2021:A01)

Broken Access Control occurs when applications do not properly enforce restrictions on authenticated users, allowing them to access or modify data outside their permission scope. Examples include bypassing authorization checks, manipulating URLs or APIs, or elevating user privileges. Such vulnerabilities can result in unauthorized access to sensitive information, altering of critical data, or even complete account takeover. This issue often arises due to misconfigured access rules or lack of centralized authorization logic. Addressing this risk involves implementing strong role-based access control (RBAC), thorough testing, and ensuring consistent enforcement of authorization rules across all parts of the application.

Cryptographic Failures (OWASP 2021:A02)

Cryptographic Failures, previously categorized as “Sensitive Data Exposure,” occur when sensitive data is inadequately protected using cryptography. Common examples include weak encryption algorithms, improper key management, and transmitting sensitive data in plaintext. These failures can lead to data breaches, exposing user credentials, financial data, or other private information to attackers. Organizations often overlook secure implementation of cryptographic standards, leaving data vulnerable during storage or transit. To mitigate this, developers should use modern cryptographic algorithms, enforce secure communication protocols like HTTPS, and adopt robust practices for key management and data protection.

Injection (OWASP 2021:A03)

Injection flaws occur when untrusted data is sent to an interpreter as part of a query or command, enabling attackers to execute unintended commands. Common forms include SQL injection, NoSQL injection, and command injection, all of which can lead to data theft, data manipulation, or complete compromise of the underlying system. These vulnerabilities typically arise due to insufficient input validation and insecure query construction. Attackers exploit these flaws to bypass authentication, extract sensitive information, or alter the application’s behavior. Preventing injection attacks requires parameterized queries, input sanitization, and using Object Relational Mapping (ORM) tools to separate user inputs from executable code.

Insecure Design (OWASP 2021:A04)

Insecure Design refers to fundamental flaws in an application’s architecture or workflows, which create exploitable vulnerabilities. Unlike coding issues, these problems stem from inadequate planning and threat modeling during the design phase. Examples include overly complex permission structures, lack of secure default settings, or absence of account lockout mechanisms for brute force protection. This risk highlights the importance of integrating security into the software development lifecycle (SDLC) from the very beginning. To address insecure design, organizations should adopt secure design principles, conduct regular threat modeling exercises, and ensure that security requirements are built into every phase of development.

Security Misconfiguration (OWASP 2021:A05)

Security Misconfiguration occurs when applications, servers, or networks are improperly configured, leaving them exposed to attacks. Examples include leaving default credentials unchanged, enabling unnecessary features, or failing to disable debugging modes in production. Misconfigurations can provide attackers with easy entry points, allowing them to exploit vulnerabilities, access sensitive data, or compromise systems. This risk often arises from inconsistent security practices, lack of automation, or inadequate testing of deployment environments. Mitigation involves enforcing secure defaults, conducting regular configuration reviews, and automating security checks as part of continuous integration and deployment (CI/CD) pipelines.

Vulnerable and Outdated Components (OWASP 2021:A06)

This risk highlights the dangers of relying on outdated or unpatched software components, including libraries, frameworks, and APIs. Attackers often exploit known vulnerabilities in these components to gain unauthorized access or compromise systems. Using such components can also introduce compatibility issues or disrupt application performance. Many organizations fail to track or update dependencies, leading to significant security gaps. To address this, organizations should maintain an up-to-date inventory of dependencies, use tools for Software Composition Analysis (SCA), and establish automated processes to apply patches or updates as soon as they are available.

Identification and Authentication Failures (OWASP 2021:A07)

Weak or improperly implemented identification and authentication mechanisms can allow attackers to impersonate legitimate users or compromise accounts. Examples include insecure password storage, lack of multi-factor authentication (MFA), or allowing unlimited login attempts. These failures can lead to account takeovers, unauthorized data access, or further exploitation of the system. Organizations often underestimate the importance of robust authentication, relying on outdated or insecure practices. To mitigate this risk, developers should implement strong password policies, enforce MFA wherever possible, and use secure authentication frameworks to minimize vulnerabilities.

Software and Data Integrity Failures (OWASP 2021:A08)

Software and Data Integrity Failures occur when applications fail to validate the integrity of software updates, libraries, or dependencies. Attackers exploit these gaps by injecting malicious code into updates or compromising supply chains. This can lead to the deployment of compromised applications or unauthorized access to sensitive data. Examples include allowing unsigned software updates or using libraries from unverified sources. To prevent such failures, organizations should adopt signed software practices, validate external dependencies, and implement strict controls for monitoring changes in the software supply chain.

Security Logging and Monitoring Failures (OWASP 2021:A09)

Inadequate logging and monitoring can leave organizations blind to ongoing attacks or prevent them from detecting breaches in a timely manner. Without proper logging, incidents such as brute force attacks, unauthorized access, or data exfiltration may go unnoticed. Many organizations fail to prioritize logging due to performance concerns or lack of expertise. Effective security monitoring includes centralized logging, timely alerting, and regular review of log data to detect anomalies. Implementing robust logging frameworks and integrating them with Security Information and Event Management (SIEM) systems can significantly enhance an organization’s incident response capabilities.

Server-Side Request Forgery (SSRF) (OWASP 2021:A10)

Server-Side Request Forgery (SSRF) occurs when an attacker tricks a server into making requests to unauthorized or unintended resources. This can lead to the exposure of sensitive data, access to internal systems, or even full compromise of the server. SSRF vulnerabilities often arise when applications fetch external resources without validating the user-provided URLs. Attackers can exploit this to bypass firewalls, interact with internal APIs, or exfiltrate sensitive information. To mitigate SSRF, organizations should validate and sanitize user inputs, enforce allowlists for external requests, and apply strict firewall rules to limit access to internal resources.

Examples of the OWASP Top 10 Security Risks

Control Name	Examples
Broken Access Control	– Insecure Direct Object Reference (IDOR). A route that allows accessing a resource by ID without checking if the user owns it. – Missing function-level access control. An admin route that doesn’t check if the user is an admin. – Bypassing authorization checks by modifying request parameters (e.g., changing from GET to POST to bypass checks).
Cryptographic Failures	– Storing passwords in plaintext in the database. – Using a weak hashing algorithm like MD5. – Hardcoding encryption keys in the source code.
Injection	– SQL injection by concatenating user input into a query. – Command injection by executing user input in a shell command. – NoSQL injection in a MongoDB query by passing unsanitized input.
Insecure Design	– Allowing password reset without verifying the user’s identity. – Open redirect vulnerabilities – Not implementing anti-CSRF tokens, assuming the client will handle it.
Security Misconfiguration	– Leaving debug mode enabled in production, exposing detailed errors. – Using default credentials for a database or admin account. – Not securing HTTP headers, leading to clickjacking or other attacks.
Vulnerable and Outdated Components	– Using an outdated version of a library with known vulnerabilities. – Not updating dependencies regularly, leading to unpatched vulnerabilities. – Using a deprecated function that’s no longer maintained.
Identification and Authentication Failures	– Allowing weak passwords like ‘123456’. – Not implementing account lockout after multiple failed attempts. – Storing session IDs insecurely, leading to session hijacking.
Software and Data Integrity Failures	– Downloading a library from an untrusted source without verification. – Using insecure deserialization that allows executing arbitrary code. – Not verifying checksums of uploaded files, leading to malware.
Security Logging and Monitoring Failures	– Not logging failed login attempts. – Storing logs with sensitive information in plaintext. – Not monitoring logs for brute-force attack patterns.
Server-Side Request Forgery (SSRF)	– Fetching a user-supplied URL without validation. – Allowing access to internal network resources via a vulnerable endpoint. – Not restricting allowed URL schemes, enabling file:// or other dangerous schemes.