Java Application Security: Top 10 Vulnerabilities for Beginners

Java Application Security: Top 10 Vulnerabilities for Beginners

Java remains one of the most popular programming languages for building enterprise and web applications. However, like any other language, it is susceptible to attacks. For beginner developers, understanding the basics of security is not just good practice, but an essential skill. In this article, we will break down the top 10 most common vulnerabilities in Java applications, provide code examples, and explain how to protect your project.

1. SQL Injection

This is one of the oldest and most dangerous vulnerabilities. It occurs when user input is directly inserted into an SQL query without prior sanitization.

Example of vulnerable code:

String query = "SELECT * FROM users WHERE username = '" + userInput + "'";Statement stmt = connection.createStatement();ResultSet rs = stmt.executeQuery(query);

An attacker can pass a value like ' OR '1'='1 into userInput, which will return all data from the table.

How to protect: Always use PreparedStatement.

String query = "SELECT * FROM users WHERE username = ?";PreparedStatement pstmt = connection.prepareStatement(query);pstmt.setString(1, userInput);ResultSet rs = pstmt.executeQuery();

2. Cross-Site Scripting (XSS)

XSS attacks allow injecting a malicious script into a web page, which then executes in the victim's browser. Java servlets and JSP often fall victim to this vulnerability if they do not escape output.

Example of vulnerable code:

out.println("<p>Hello, " + request.getParameter("name") + "</p>");

How to protect: Escape HTML characters or use modern template engines (e.g., Thymeleaf or JSP with JSTL).

// Using the Apache Commons Lang libraryString safeInput = StringEscapeUtils.escapeHtml4(userInput);out.println("<p>Hello, " + safeInput + "</p>");

3. Cross-Site Request Forgery (CSRF)

CSRF forces a user to perform an unwanted action on a site where they are authenticated, such as transferring money or changing a password.

Example of vulnerability:

<img src="https://bank.com/transfer?amount=1000&to=hacker" />

How to protect: Use CSRF tokens. In Spring Security, this is done automatically when protection is enabled.

// Enabling CSRF protection in Spring Securityhttp.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

4. Insecure Deserialization

Java allows restoring objects from byte streams. If an attacker can pass a malicious serialized object, it can lead to arbitrary code execution.

Example of vulnerable code:

ObjectInputStream ois = new ObjectInputStream(request.getInputStream());Object obj = ois.readObject(); // Potentially dangerous operation

How to protect:

• Do not deserialize data from untrusted sources.
• Use allowlists of classes.
• Use alternatives like JSON (Jackson/Gson) with validation.

5. Dependency Vulnerabilities

Modern Java projects use dozens of third-party libraries (Maven, Gradle). Outdated or vulnerable versions are a common cause of breaches.

How to protect:

• Regularly update dependencies.
• Use analysis tools: OWASP Dependency-Check, Snyk, GitHub Dependabot.
• Add checks to your CI/CD pipeline.

6. Insecure Authentication and Session Management

Weak