OWASP Top Ten 2017 Security Misconfiguration

Overview

This page provides information about A6:2017-Security Misconfiguration, one of the OWASP Top Ten 2017 vulnerabilities. It explains the threat agents, attack vectors, security weakness, impacts, and ways to prevent security misconfigurations. It also includes example attack scenarios and references for additional resources.

Description

A6:2017-Security Misconfiguration is a security vulnerability that occurs when an application or system is not properly configured, leaving it exposed to potential attacks. This can happen at any level of an application stack, including network services, platforms, web servers, application servers, databases, frameworks, custom code, and pre-installed virtual machines or containers. Attackers can exploit security misconfigurations to gain unauthorized access to systems or sensitive data, leading to complete system compromises. The impact of security misconfigurations depends on the protection needs of the application and data.

How to Prevent ?

To prevent security misconfigurations, it is important to implement secure installation processes and follow security best practices. This includes performing a repeatable hardening process that ensures all environments are properly locked down, removing unnecessary features and frameworks, reviewing and updating configurations, implementing a segmented application architecture, sending security directives to clients, and regularly verifying the effectiveness of configurations and settings.

Example Attack Scenarios:

• Scenario #1: Sample Applications with Default Accounts:  The application server contains sample applications with known security flaws. If these sample applications are not removed from the production server and default accounts are not changed, attackers can exploit these flaws to compromise the server and gain administrative access.

• Scenario #2: Directory Listing Enabled:  If directory listing is not disabled on the server, attackers can easily list directories and access compiled Java classes. By decompiling and reverse engineering the code, attackers can identify access control flaws and potentially exploit them.

• Scenario #3: Detailed Error Messages:  When an application server's configuration allows detailed error messages, attackers can gain access to sensitive information or identify underlying flaws. This includes exposing stack traces and component versions that are known to be vulnerable.

• Scenario #4: Default Sharing Permissions in Cloud Services:  In cloud service environments, default sharing permissions may be open to the internet by other users. This can lead to unauthorized access to sensitive data stored in cloud storage.