Security of Java Applications: Top 10 Vulnerabilities and How to Avoid Them

Introduction: Why Java Application Security Is Critical

Java remains one of the most popular languages for building enterprise and web applications. However, popularity also attracts increased attention from attackers. According to OWASP (Open Web Application Security Project), most breaches occur due to common developer mistakes, not vulnerabilities in the platform itself. In this article, we will analyze the top 10 most dangerous Java application vulnerabilities, show code examples, and provide practical recommendations for protection.

1. SQL Injection

Problem: Passing unvalidated user input into an SQL query.

Example of vulnerable code:

String query = "SELECT * FROM users WHERE username = '" + userInput + "'";Statement stmt = connection.createStatement();ResultSet rs = stmt.executeQuery(query);

Solution: Use parameterized queries (PreparedStatement).

String query = "SELECT * FROM users WHERE username = ?";PreparedStatement pstmt = connection.prepareStatement(query);pstmt.setString(1, userInput);ResultSet rs = pstmt.executeQuery();

2. Cross-Site Scripting (XSS)

Problem: Injecting malicious scripts into a web page through user input.

Example of vulnerability:

String comment = request.getParameter("comment");out.println("<div>" + comment + "</div>");

Solution: Escape HTML characters. Use libraries like OWASP Java Encoder.

import org.owasp.encoder.Encode;String comment = request.getParameter("comment");out.println("<div>" + Encode.forHtml(comment) + "</div>");

3. Insecure Deserialization

Problem: An attacker can pass a serialized object that, upon deserialization, executes arbitrary code.

Example:

ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());Object obj = ois.readObject(); // Dangerous!

Solution:

• Do not deserialize data from untrusted sources.
• Use class whitelists (look-ahead deserialization).
• Use JSON (Jackson) with security settings.

ObjectMapper mapper = new ObjectMapper();mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL); // Unsafe!// Correct: disable defaultTyping and use @JsonTypeInfo

4. Cross-Site Request Forgery (CSRF)

Problem: An attacker forces a user to perform an unwanted action on a trusted site.

Solution: Use CSRF tokens. In Spring Security this is built-in:

<form action="/transfer" method="post">    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>    <input type="text" name="amount"/>    <button type="submit">Transfer</button></form>

5. Broken Authentication and Session Management

Problems: Weak passwords, unprotected cookies, fixed sessions.

Recommendations:

• Use bcrypt or Argon2 for password hashing.
• Set HttpOnly and Secure flags for cookies.
• Implement account lockout after N failed login attempts.

PasswordEncoder encoder = new BCryptPasswordEncoder();String hashedPassword = encoder.encode(plainPassword);

6. Security Misconfiguration

Problem: Enabled debug modes, default passwords, unprotected endpoints.

Solution: