Tuesday, December 3, 2024
HomeOWASP - Top 10OWASP A5- Security Misconfiguration

OWASP A5- Security Misconfiguration

Published on

SIEM as a Service

Security Misconfiguration prevalence are quiet common and this risk can be easily exploited,anyway the impact of risk would be moderate. It completely depends upon how bad the security Misconfiguration is, it narrow downs the attacker to gain access to unsecured area(Insecure weblogs,Internal error,Insecure admin page).

secmis

With this risk the website exposes the sensitive data which act’s as a gateway, which attacker may use to exploit the server in future.

Understanding Server Misconfiguration

  • Is any of your software out of date? that includes OS, Webb/App server, Databases,Applications and all code libraries.
  • Any unnecessary features enabled or installed?(Ports, Services, Pages,privileges).
  • Are default account’s and password still enabled/unchanged?
  • Does your error handling mechanism reveals stack traces or other informative error messages.
  • Are the security settings in your development framework and libraries are not set to secure values.

Am I Vulnerable To ‘Security Misconfiguration’?

Is your application missing the proper security hardening across any part of the application stack? Including:

- Advertisement - SIEM as a Service
  1. Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
  2. Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
  3. Are default accounts and their passwords still enabled and unchanged?
  4. Does your error handling reveal stack traces or other overly informative error messages to users?
  5. Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?

Without a concerted, repeatable application security configuration process, systems are at a higher risk.

How Do I Prevent ‘Security Misconfiguration’?

The primary recommendations are to establish all of the following:

  1. A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
  2. A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include all code libraries as well (see new A9).
  3. A strong application architecture that provides effective, secure separation between components.
  4. Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.

Example Attack Scenarios

Scenario #1: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.

Scenario #2: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.

Scenario #3: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.

Scenario #4: App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server.

 Common Defenses

  • Harden the installation(Turn off unwanted features, Apply principle of least privilege).
  • Tune the app(Ensure it’s production ready, Defaults are not right).
  • Ensure packages up to date(Be conscious on third party tools risk, Have a strategy to monitor and update)

Examples of mitigating the Risk

Detecting privelance of security mis-configuration, what we are going to use is a Google dork and the search results for Elmah (Error Logging Modules and Handlers) this is a very popular third party library for capturing and logging error’s and only administrators can have access to it.

With a carefully crafted Google search query inurl:elmah.axd “error log for” we can get unsecured results which vae database passwords, Authtokens. Hope-full it demonstrates how easy to mitigate the risk and execution.

Also Read:

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

PEFT-As-An-Attack, Jailbreaking Language Models For Malicious Prompts

Federated Parameter-Efficient Fine-Tuning (FedPEFT) is a technique that combines parameter-efficient fine-tuning (PEFT) with federated...

Hackers Cloning Websites, Exploiting RCE Flaws To Gain Access To Shopping Platforms

Cybercriminals are leveraging AI-powered phishing attacks, website cloning tools, and RCE exploits to target...

Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration

wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By...

Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform

Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

What is XSS (Cross-Site Scripting)? – A Detailed Understanding Of the Type of XSS

XSS is a very commonly exploited vulnerability type that is very widely spread and...

Cross-Site Request Forgery (CSRF) – An OWASP Vulnerability – Detailed Explanation

Cross Site Request Forgery is one of the most common form of attack by...

OWASP A10-Unvalidated Redirects and Forwards

Web applications often redirect and forward users to other pages and websites, and use...