Get a free application, infrastructure and malware scan report - Scan Your Website Now

Subscribe to our Newsletter
Try AppTrana WAAP (WAF)
Managed WAF Start at $99

OWASP Security Misconfiguration Vulnerability

Posted DateAugust 13, 2014
Posted Time 3   min Read

Application Security Misconfiguration attacks exploit configuration weaknesses found in web applications. Many applications come with necessary developer features that are dangerously unsafe if not deactivated during live production, such as debug and QA features. These features may provide means for a hacker to bypass authentication methods and gain access to sensitive information, perhaps with elevated privileges.

Default installations may include well-known usernames and passwords, hard-coded backdoor accounts, special access mechanisms, and incorrect permissions set for files accessible through web servers. Default samples may be accessible in production environments. Application-based configuration files that are not properly locked down may reveal clear text connection strings to the database, and default settings in configuration files may not have been set with security in mind. All of these misconfigurations may lead to unauthorized access to sensitive information. It should come as no surprise that Security Misconfiguration Vulnerability as made it to the top of the OWASP Top 10 vulnerabilities list.

Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.

Commonly Found Vulnerable Postures:

  • The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
  • Directory listing is not disabled on your server. The attacker discovers she can simply list directories to find any file. The attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.
  • App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
  • The app server comes with sample applications that are not removed from your production server. Said sample applications have well-known security flaws attackers can use to compromise your server.

Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, Web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date. If an application lacks proper security controls, an attacker can potentially access default accounts, unused pages, or unprotected files or exploit unpatched flaws to gain unauthorized access to or knowledge of the system.

Are You Vulnerable To ‘Security Misconfiguration’?

Is your application missing the proper security hardening across any part of the application stack? Including:

  1. Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
  2. Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
  3. Are default accounts and their passwords still enabled and unchanged?
  4. Does your error handling reveal stack traces or other overly informative error messages to users?
  5. Are the security settings in your development frameworks (e.g., Struts, Spring, and ASP.NET) and libraries not set to secure values?

How to Prevent Security Misconfiguration?

The primary recommendations are to establish all of the following:

  1. A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to set up a new secure environment.
  2. A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment.
  3. A strong application architecture that provides effective, secure separation between components.
  4. Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches. Also, consider virtually patching where applicable in WAF (hiding error messages) while the issue is fixed in your application which is sitting behind WAF.

OWASP, Wikipedia, PC Magazine, CIS Security Configuration Guides

web application security banner

Spread the love

Join 47000+ Security Leaders

Get weekly tips on blocking ransomware, DDoS and bot attacks and Zero-day threats.

We're committed to your privacy. indusface uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.

Related Posts

How to Detect Security Misconfiguration
How are Security Misconfigurations Detected, Diagnosed and Determined?

Security misconfigurations, one of the OWASP Top 10 Vulnerabilities, are known to erode the security posture immensely owing to their common occurrence and easy exploitability. When such vulnerabilities are not.

Spread the love

Read More


Fully Managed SaaS-Based Web Application Security Solution

Get free access to Integrated Application Scanner, Web Application Firewall, DDoS & Bot Mitigation, and CDN for 14 days

Know More Take Free Trial


Indusface is the only cloud WAAP (WAF) vendor with 100% Customer Recommendation for 3 consecutive years.

A Customers’ Choice for 2022 and 2023 - Gartner® Peer Insights™

The reviews and ratings are in!