# Top 10 2017-A5-Security Misconfiguration

From OWASP

==The Top 10-2017 Wiki is under Construction. The Content is Not Finished yet.==
==Edits to this page will be lost. If you wish a change, please file an issue on GitHub. ==

← A4-Broken Access Control | 2017 Table of Contents 2017 Top 10 List | A6-Sensitive Data Exposure →

Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts
--- | --- | --- | --- | ---
Application Specific | Exploitability EASY | Prevalence COMMON | Detectability EASY | Impact MODERATE | Application / Business Specific
Consider anonymous external attackers as well as authorized users that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. | Attackers access default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. | Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, frameworks, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. | Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise. | The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time. Recovery costs could be expensive.

Am I Vulnerable To 'Security Misconfiguration'? Is your application missing the proper security hardening across any part of the application stack? Including: Is any of your software out of date? This software includes the OS, Web/App Server, DBMS, applications, APIs, and all components and libraries (see 2017-A9). Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)? Are default accounts and their passwords still enabled and unchanged? Does your error handling reveal stack traces or other overly informative error messages to users? Are the security settings in your application servers, application frameworks (e.g., Struts, Spring, ASP.NET), libraries, databases, etc. not set to secure values? Without a concerted, repeatable application security configuration process, systems are at a higher risk. | How Do I Prevent 'Security Misconfiguration'? The primary recommendations are to establish all of the following: A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment. A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This process needs to include all components and libraries as well (see 2017-A9). A strong application architecture that provides effective, secure separation between components. An automated process to verify that configurations and settings are properly configured in all environments.
Example Attack Scenarios Scenario #1: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over. Scenario #2: Directory listing is not disabled on your web server. An attacker discovers they can simply list directories to find any file. The attacker finds and downloads all your compiled Java classes, which they decompile and reverse engineer to get all your custom code. Attacker then finds a serious access control flaw in your application. Scenario #3: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws such as framework versions that are known to be vulnerable. Scenario #4: App server comes with sample applications that are not removed from your production server. These sample applications have well known security flaws attackers can use to compromise your server. | References OWASP OWASP Development Guide: Chapter on Configuration OWASP Code Review Guide: Chapter on Error Handling OWASP Testing Guide: Configuration Management OWASP Testing Guide: Testing for Error Codes OWASP Top 10 2004 - Insecure Configuration Management For additional requirements in this area, see the ASVS requirements areas for Security Configuration (V11 and V19). External NIST Guide to General Server Hardening CWE Entry 2 on Environmental Security Flaws CIS Security Configuration Guides/Benchmarks

← A4-Broken Access Control | 2017 Table of Contents 2017 Top 10 List | A6-Sensitive Data Exposure →

© 2002-2017 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved.
Retrieved from "https://www.owasp.org/index.php?title=Top_10_2017-A5-Security_Misconfiguration&oldid=229017"
Categories:

- OWASP Top Ten Project
- OWASP Top Ten 2017 Project