OWASP Top 10. Mapped to Deva detection.

What it is

Broken access control is the most prevalent category in the OWASP Top 10 (2021), affecting 94% of applications tested in the OWASP Foundation's data set. It covers any path by which a user performs an action they should not be authorized to perform: bypassing access checks via URL manipulation, modifying request metadata, accessing another user's resources via Insecure Direct Object Reference (IDOR), elevating privileges, or performing state changes that should require additional confirmation. Modern web frameworks ship with secure-by-default access patterns, but mis-applied or skipped checks remain the dominant root cause of disclosed breaches.

Common patterns

• •IDOR: fetching a resource by a request-supplied ID without verifying the authenticated user owns or has rights to it.
• •Skipping authorization on backend APIs because the UI does not surface a link to the action.
• •CSRF: state-changing operations that lack a token, SameSite cookie attribute, or origin check.
• •Privilege escalation through parameter tampering (role=admin in a request body).
• •Path traversal allowing read or write of files outside the intended directory.
• •CORS misconfiguration that allows credentialed requests from any origin.

CWE guides Deva ships for A01

Real-world breaches in this category

What it is

Cryptographic failures (renamed from Sensitive Data Exposure in 2021) cover any path by which sensitive data is exposed because of inadequate cryptographic protection. Manifestations include missing encryption in transit or at rest, weak algorithms (DES, MD5, SHA-1 for passwords), hardcoded credentials, weak or predictable random number generation, and improper key management. The category sits high in the OWASP Top 10 because the consequences of disclosure are immediate and often unrecoverable: leaked passwords cannot be unleaked.

Common patterns

• •Hashing passwords with fast algorithms (MD5, SHA-256) instead of bcrypt, argon2, or scrypt.
• •AES with ECB mode (visible patterns) or CBC without HMAC (padding oracle vulnerabilities).
• •Hardcoded API keys, database passwords, or signing secrets in source code.
• •Math.random or other non-cryptographic PRNGs used for tokens, session IDs, or salts.
• •HTTP endpoints transmitting credentials, tokens, or PII without TLS.
• •Stack traces, debug pages, or error responses that include sensitive system or user data.

CWE guides Deva ships for A02

Real-world breaches in this category

What it is

Injection covers any vulnerability in which an attacker supplies data that the application then passes to an interpreter (SQL, shell, OS, expression engine, template, LDAP, XPath) without proper validation or parameterization. The interpreter executes the injected content, often granting the attacker the privileges of the application's identity in that subsystem. SQL injection in particular has appeared in every published OWASP Top 10 since the document's inception, and the broader injection category remains in the top tier despite three decades of industry awareness.

Common patterns

• •SQL queries built by string concatenation or template-string interpolation of user input.
• •Shell commands constructed from request parameters (filename, URL, hostname).
• •eval, new Function, or exec called with user-controlled strings.
• •NoSQL injection through MongoDB query operators accepted from request bodies ($where, $regex).
• •LDAP injection in directory queries built from user input.
• •XSS: HTML or JavaScript injected into pages via unsanitized output.

CWE guides Deva ships for A03

Real-world breaches in this category

What it is

Insecure Design is the OWASP Top 10's recognition that some vulnerabilities are baked into the system before any line of code is written. It covers business logic flaws (rate limits that are not enforced, password reset flows that allow account takeover by design, file upload features that cannot be safely implemented), missing threat modeling, and reliance on user-supplied trust labels (privileged operations gated on a cookie value the client controls). Unlike injection or auth bugs, insecure design issues persist through code-level fixes because the design itself is the vulnerability.

Common patterns

• •File upload features without a viable threat model (allowed types, storage location, serving behavior).
• •Password reset flows that confirm reset based on knowledge of public information.
• •Rate limits enforced client-side, or applied per IP rather than per identity, or absent entirely.
• •Multi-tenant architectures that scope by request parameter rather than by the authenticated identity.
• •Privileged operations that rely on the absence of a UI link to remain undiscovered ('security by obscurity').
• •Workflows that assume an out-of-band step has occurred when it has not been verified.

CWE guides Deva ships for A04

Real-world breaches in this category

What it is

Security misconfiguration covers any deployment state in which a system is exposed because of how it is configured, not because of how it is coded. Examples include cloud storage buckets with public-read access, debug endpoints reachable in production, default credentials never changed, XML parsers with external entities enabled, unnecessary features running on production hosts, and missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options). This category is broad and consistently sits in the OWASP Top 10 because configuration drift accumulates over time even on well-built systems.

Common patterns

• •S3, GCS, or Azure Blob storage with public-read or list-bucket permissions on private data.
• •XML parsers (lxml, DocumentBuilderFactory, XmlReader) instantiated without disabling external entities (XXE).
• •Verbose error pages or debug endpoints (DEBUG=True in Flask/Django, app.debug=true in Express) live in production.
• •Default credentials on databases, admin panels, or management interfaces.
• •Security headers missing or misconfigured: no HSTS, weak CSP, missing X-Frame-Options.
• •Cloud IAM policies with wildcard resources (Resource: *) on actions that should be scoped.

CWE guides Deva ships for A05

Real-world breaches in this category

What it is

Modern applications are dominated by third-party code: a typical Node.js web app depends transitively on thousands of npm packages, each of which may have published vulnerabilities. This category covers the use of components with known vulnerabilities, components that are no longer maintained, components patched downstream but not at your version, and components that should not be in the dependency graph at all (typosquatted lookalikes, malicious package supply-chain attacks). Software Composition Analysis (SCA) is the dedicated discipline.

Common patterns

• •Direct or transitive dependencies on packages with published CVEs and available patches.
• •Versions pinned to ranges (^1.2.3) that pull in compromised versions when an upstream account is hijacked.
• •Typosquatting: installing 'reactt' (typo) instead of 'react' and getting an attacker-controlled package.
• •Out-of-date container base images that ship known-vulnerable system libraries.
• •Use of packages whose maintainers have abandoned them, leaving published vulnerabilities unpatched.
• •License-non-compliant dependencies that block release on legal grounds (not strictly security, but the same scan surface).

CWE guides Deva ships for A06

Real-world breaches in this category

What it is

This category (previously Broken Authentication) covers any failure to correctly verify the identity of an entity interacting with the application. Manifestations include missing authentication on critical functions, brute-forceable login flows, weak password policies, predictable session IDs, JWT validation that decodes but does not verify, and credential stuffing surface area without monitoring. Identification and authentication failures are the foundational weakness behind most disclosed account takeovers and an explicit control area in HIPAA, PCI-DSS, and CMMC.

Common patterns

• •Routes with no authentication middleware on sensitive paths (/admin, /internal, /debug).
• •JWT verification calls with verify:false, missing signing key, or accepting 'alg':'none'.
• •Login flows without rate limiting, account lockout, or CAPTCHA on repeated failures.
• •Password requirements that allow trivially-crackable choices ('a' or '12345').
• •Hardcoded API keys, DB passwords, or signing secrets in source.
• •Session IDs generated from predictable sources (timestamps, weak PRNG, sequential counters).

CWE guides Deva ships for A07

Real-world breaches in this category

What it is

Software and data integrity failures cover any path by which untrusted code or data flows into a trust boundary without verification. Examples include insecure deserialization (where an attacker-controlled byte stream is reconstructed into application objects), CI/CD pipelines that trust unauthenticated artifact sources, auto-update mechanisms that fetch updates over insecure channels, and dependencies installed from registries without integrity hashes. The SolarWinds Orion supply-chain attack is the canonical real-world example.

Common patterns

• •Python pickle.load on data from HTTP requests, message queues, or cache backends.
• •Java ObjectInputStream.readObject on data from network sources (gadget-chain RCE).
• •.NET BinaryFormatter on attacker-controlled bytes.
• •PHP unserialize on cookie or query-string values.
• •CI/CD steps that fetch scripts from URLs without hash pinning or signature verification.
• •Package installations without lockfile or integrity-hash verification.

CWE guides Deva ships for A08

Real-world breaches in this category

What it is

Security logging and monitoring failures cover any gap in the observability stack that lets an attack progress undetected. Common manifestations include missing logs on auth events, logs that are written but never reviewed, log storage that the attacker can also reach, log formats that lose attribution detail (no user ID, no source IP), and detection rules that exist but are not tuned. The 2021 OWASP edition added this category explicitly because it is the difference between a breach that is contained in hours and one that goes undetected for months. The mean dwell time of an undetected breach is over 200 days.

Common patterns

• •Authentication and authorization decisions logged at INFO without source IP, user ID, or correlation ID.
• •Failed login attempts not logged at all, or logged without enough metadata to detect credential stuffing.
• •Privilege changes, role assignments, or permission grants not audit-logged.
• •Application logs stored in the same blast radius as the application (attacker who compromises the app also tampers with the logs).
• •Log retention shorter than the typical breach dwell time.
• •Alerts wired to channels (email, low-priority Slack) that are not acted on.

Real-world breaches in this category

What it is

Server-Side Request Forgery is new to the OWASP Top 10 in 2021 because the rise of cloud computing made it disproportionately dangerous. An application that fetches a URL the user controls becomes an attacker-controlled proxy: the request leaves the attacker's machine but originates from inside the application's network. In cloud environments, this lets the attacker reach cloud-metadata services (AWS IMDS, GCP metadata) that hand out IAM credentials to local-network callers, internal databases, admin interfaces, and other services not exposed to the public internet.

Common patterns

• •User-supplied URLs passed to fetch, axios, requests, urlopen, http.Client.Do.
• •Image, document, or video preview features that fetch URLs the user provides.
• •Webhook delivery to user-configured destinations without allowlist validation.
• •Server-side OAuth or OpenID Connect discovery fetches against attacker-supplied issuer URLs.
• •PDF generation or screenshot services where the user supplies the URL to render.
• •XML External Entity attacks pivoting to SSRF via SYSTEM URL entities.

CWE guides Deva ships for A10

Real-world breaches in this category