Organizations Paid Hackers $23.5 Million for These 10 Vulnerabilities in One Year

In times of uncertainty, security becomes an ever more pressing priority. The stakes are high: organizations are more reliant on technology than ever and anyone relying on technology can lose everything in a data breach. But some of the most recent vulnerabilities have one thing in common: they were detected, discovered and reported by friendly hackers who can think like attackers.

“This year, organizations worldwide were forced to go digital with their product offerings and services,” said HackerOne Senior Director of Product Management Miju Han. “Businesses scrambled to find new revenue streams, creating digital offerings for customers whose lifestyles had dramatically changed. Tens of millions of workers started working remotely whether or not they were ready. With this accelerated pace of digital transformation, CISOs had to quickly facilitate new needs while ensuring the security of existing systems. Faced with these obstacles, security leaders have gained newfound appreciation for hacker-powered security as a nimble, scalable, and cost-effective solution to augment their own resources and offer a pay-for-results approach that’s more justifiable under tightened budgets.”

HackerOne maintains the most authoritative database of vulnerabilities in the industry. With over 200,000 valid vulnerabilities found by hackers, HackerOne took a look into this data to glean insights from the top 10 most impactful and rewarded vulnerability types.

HackerOne’s Top 10 Most Impactful and Rewarded Vulnerability Types of 2020, in descending order, are:

1. Cross-site Scripting (XSS)
2. Improper Access Control 
3. Information Disclosure
4. Server-Side Request Forgery (SSRF)
5. Insecure Direct Object Reference (IDOR)
6. Privilege Escalation
7. SQL Injection
8. Improper Authentication 
9. Code Injection
10. Cross-Site Request Forgery (CSRF)

Taking a closer look at this year’s top ten in comparison to the 2019 top ten vulnerabilities, key findings include:

• Cross-site Scripting vulnerabilities continue to be a major threat to web applications as attackers exploiting XSS attacks can gain control of the user’s account and steal personal information such as passwords, bank account numbers, credit card info, personally identifiable information (PII), social security numbers, and more. The most awarded vulnerability two-years running, XSS vulnerabilities cost organizations US$4.2 million in total bounty awards, up 26% from the previous year. These bugs account for 18% of all reported vulnerabilities, but the average bounty award is just US$501. With the average bounty for a critical vulnerability being $3,650, this means organizations are mitigating this common, potentially painful bug on the cheap.
• Improper Access Control (up from ninth place in 2019) and Information Disclosure (still holding the third spot) remain common. Awards for Improper Access Control increased 134% year over year to just over US$4 million. Information Disclosure was not far behind, increasing 63% year over year. Access control design decisions have to be made by humans, not technology, and the potential for errors is high, and both errors are nearly impossible to detect using automated tools. 
• SSRF vulnerabilities, which can be exploited to target internal systems behind firewalls, show the risk of cloud migrations. Previously, SSRF bugs were fairly benign and held our seventh place spot, as they only allowed internal network scanning and sometimes access to internal admin panels. But in this era of rapid digital transformation, the advent of cloud architecture and unprotected metadata endpoints has rendered these vulnerabilities increasingly critical.
• SQL Injection is dropping year-over-year. Considered one of the worst threats to web application security by OWASP and others, the scale of SQL injection attacks can be devastating, as sensitive data, including business information, intellectual property, and critical customer data, is stored on database servers susceptible to these attacks. In years past, SQL injection was one of the most common vulnerability types. However, our data indicate that it’s been dropping year-over-year from fifth in 2019 to seventh in 2020. By shifting security left, organizations are leveraging hackers and other methods to proactively monitor attack surfaces and prevent bugs from entering code.

“Finding the most common vulnerability types is inexpensive,” Han continued. “Of the top 10 most awarded weakness types, only Improper Access Control, Server-Side Request Forgery (SSRF), and Information Disclosure saw their average bounty awards rise more than 10%. The others fell in average value or were nearly flat. Unlike traditional security tools and methods, which become more expensive and cumbersome as goals change and attack surface expands, hacker-powered security is actually more cost-effective as time goes on. With hackers, it’s becoming less expensive to prevent bad actors from exploiting the most common bugs.”

For the full HackerOne Top 10 Most Impactful and Rewarded Vulnerability Types - 2020 Edition, please visit https://www.hackerone.com/top-ten-vulnerabilities

About HackerOne
HackerOne empowers the world to build a safer internet. As the world’s most trusted hacker-powered security platform, HackerOne gives organizations access to the largest community of hackers on the planet. Armed with the most robust database of vulnerability trends and industry benchmarks, the hacker community mitigates cyber risk by searching, finding, and safely reporting real-world security weaknesses for organizations across all industries and attack surfaces. Customers include The U.S. Department of Defense, Dropbox, General Motors, GitHub, Goldman Sachs, Google, Hyatt, Intel, Lufthansa, Microsoft, MINDEF Singapore, Nintendo, PayPal, Qualcomm, Slack, Starbucks, Twitter, and Verizon Media. HackerOne was ranked fifth on the Fast Company World’s Most Innovative Companies list for 2020. Headquartered in San Francisco, HackerOne has a presence in London, New York, the Netherlands, France, Singapore, and over 70 other locations across the globe.

Methodology
This edition of the HackerOne Top 10 Most Impactful and Rewarded Vulnerability Types was based on HackerOne’s proprietary data examining security weaknesses resolved on the HackerOne platform between May 2019 and April 2020. Vulnerabilities included here were reported by the hacker community through vulnerability disclosures and public and private bounty programs. All vulnerability classifications were made or confirmed by HackerOne customers, including weakness type, impact, and severity.

Note: The vulnerability rating taxonomy, which HackerOne maps to the industry standard Common Weakness Enumeration, is used by HackerOne customers and hackers to categorize reported vulnerabilities. Data presented here is from May 2019 through April 2020.