Java Application Security: Top 10 Vulnerabilities and How to Avoid Them

Introduction: Why Java Application Security is Not an Option, but a Necessity

Java remains one of the most popular languages for developing enterprise and web applications. However, popularity also brings increased attention from attackers. According to OWASP (Open Web Application Security Project), code vulnerabilities annually lead to data breaches and financial losses amounting to billions of dollars. In this article, we will break down the top 10 Java application vulnerabilities, show real code examples, and provide specific recommendations for protection. The material will be useful for both beginner and experienced developers striving to write secure code.

1. Injections: SQL, LDAP, and Command Injection

Injections remain the king of vulnerabilities. The most common case is SQL injection, where user input is directly concatenated into an SQL query.

Example of Vulnerable Code

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "'";Statement stmt = connection.createStatement();ResultSet rs = stmt.executeQuery(query);

If an attacker passes admin' OR '1'='1, they will gain access to all users.

How to Protect

• Use PreparedStatement: parameterized queries automatically escape input.
• Validate input data on the server side (whitelists).
• For LDAP and OS commands, use escaping and avoid calling Runtime.exec() with user data.

// Safe variantString query = "SELECT * FROM users WHERE username = ?";PreparedStatement pstmt = connection.prepareStatement(query);pstmt.setString(1, request.getParameter("user"));ResultSet rs = pstmt.executeQuery();

2. Broken Authentication and Session Management

Weak authentication is the second most dangerous vulnerability. Common issues include: lack of login attempt limits, storing passwords in plaintext, and predictable session IDs.

Recommendations

• Store passwords only as salted hashes (e.g., bcrypt or Argon2).
• Use SecureRandom for generating session tokens.
• Set session timeouts and a "remember me" mechanism with a secure token.

// Generating a secure session IDimport java.security.SecureRandom;String sessionId = new SecureRandom().ints(48, 122)    .filter(i -> Character.isLetterOrDigit(i))    .limit(64)    .collect(StringBuilder::new, StringBuilder::appendCodePoint, StringBuilder::append)    .toString();

3. XSS (Cross-Site Scripting)

XSS allows injecting malicious JavaScript into a page viewed by other users. This is especially dangerous for Java web applications using JSP or Thymeleaf.

Example of Vulnerability

<div>${userComment}</div>

If userComment contains <script>alert('XSS')</script>, the code will execute in the browser.

Protection

• Escape output: in JSP use c:out or fn:escapeXml().
• For Thymeleaf — th:utext is dangerous, use th:text.
• Apply Content Security Policy (CSP) headers.

4. Insecure Deserialization

Java deserialization is one of the most critical vulnerabilities, allowing arbitrary code execution (RCE). An attacker can tamper with the byte stream and inject a malicious object.

Example of an Attack

ObjectInputStream ois = new ObjectInputStream(request.getInputStream());Object obj = ois.readObject(); // Danger!

How to Protect

• Do not deserialize