29. OWASP Top 10 Web Vulnerabilities
29.7 The Rest: Design, Components, Integrity, Logging, SSRF
| # | Risk | One-line fix |
|---|---|---|
| A04 Insecure Design | Missing security thinking in the design itself | Threat-model early; add rate limits, validation and abuse cases by design |
| A05 Security Misconfiguration | Default passwords, dir listing, verbose errors, open ports | Harden configs (Chapter 8/28), hide versions, turn off debug, patch |
| A06 Vulnerable Components | Old libraries/plugins with known CVEs | Track dependencies, update often, remove unused ones (WPScan, Chapter 21) |
| A08 Integrity Failures | Trusting unsigned updates/data, insecure deserialization | Verify signatures/checksums, do not deserialize untrusted data |
| A09 Logging/Monitoring Failures | Attacks unnoticed because nothing is logged | Log security events and monitor them (SOC, Chapter 31) |
| A10 SSRF | Server fetches a URL the user controls, reaching internal systems | Allow-list destinations; block internal/metadata IPs |
SSRF matters a lot in the cloud: a server tricked into fetching http://169.254.169.254/ (the AWS metadata address) can leak credentials. Fix: block that address, use IMDSv2, and allow-list outbound URLs (more in Chapter 30).
Ravindra Bagale's Tip
A06 (juna components) sarvat durlakshit pan sarvat sopa-to-exploit aahe. composer, npm, WordPress plugins – regularly update kara. Attacker la tumcha code shodhaychi garaj nahi; ek juna library cha known CVE purto. Update karne ha swast ani prabhavi bachav aahe.
Practice task
For your reels app, list its components (PHP version, libraries, JS packages) and check whether any are outdated. Write one action for each of A05, A06 and A10 that you would apply to your own server.