Top 10-2017 A6-Security Misconfiguration - Revision history

T.Gigler: Editorial change (internal link: underlined and bold)

2018-01-01T16:42:53Z

Editorial change (internal link: underlined and bold)

T.Gigler: Prepare OWASP Top 10-2017 Release (Content)

2017-12-14T23:30:20Z

Prepare OWASP Top 10-2017 Release (Content)

Show changes

T.Gigler: Updated Navigation (incl PrevLink and NextLink)

2017-12-12T00:27:55Z

Updated Navigation (incl PrevLink and NextLink)

T.Gigler: T.Gigler moved page Top 10 2017-A5-Security Misconfiguration to Top 10-2017 A6-Security Misconfiguration: OWASP Top 10-2017 Release

2017-12-11T22:45:09Z

T.Gigler moved page Top 10 2017-A5-Security Misconfiguration to Top 10-2017 A6-Security Misconfiguration: OWASP Top 10-2017 Release

T.Gigler: Internationalized the Links to 2017-A9

2017-04-22T23:48:24Z

Internationalized the Links to 2017-A9

T.Gigler: Top 10 2017 RC1: A5-Security Misconfiguration

2017-04-22T22:42:36Z

Top 10 2017 RC1: A5-Security Misconfiguration

T.Gigler: Added some comments in Wiki source code of the SummaryTable Header (SummaryTableRowStyleTemplates)

2017-04-22T22:17:18Z

Added some comments in Wiki source code of the SummaryTable Header (SummaryTableRowStyleTemplates)

T.Gigler: Launch the new page for Top 10 2017-A5-Security Misconfiguration (RC1) with content of 2013-A5 as a reference to compare changes

2017-04-20T23:00:04Z

Launch the new page for Top 10 2017-A5-Security Misconfiguration (RC1) with content of 2013-A5 as a reference to compare changes

New page

{{Top_10_2013:TopTemplate
|usenext=2013NextLink
|next=A6-{{Top_10_2010:ByTheNumbers
|6
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A4-{{Top_10_2010:ByTheNumbers
|4
|year=2017
|language=en}}
|year=2017
|language=en
}}

{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
{{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=1|impact=2|year=2017|language=en}}
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.

</td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.

</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.

Recovery costs could be expensive

</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.

Recovery costs could be expensive.</td>
{{Top_10_2010:SummaryTableEndTemplate|year=2017}}

{{Top_10:SubsectionTableBeginTemplate|type=main|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2017|language=en}}
Is your application missing the proper security hardening across any part of the application stack? Including:
# Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
# Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
# Are default accounts and their passwords still enabled and unchanged?
# Does your error handling reveal stack traces or other overly informative error messages to users?
# Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?

Without a concerted, repeatable application security configuration process, systems are at a higher risk.

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=5|year=2017|language=en}}
The primary recommendations are to establish all of the following:
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include '''all code libraries as well (see new A9)'''.
# A strong application architecture that provides effective, secure separation between components.
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2017|language=en}}
'''Scenario #1:''' The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.

'''Scenario #2:''' Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.

'''Scenario #3:''' App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.

'''Scenario #4:''' App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server.
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2017|language=en}}
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
* [https://www.owasp.org/index.php/Configuration OWASP Development Guide: Chapter on Configuration]
* [https://www.owasp.org/index.php/Error_Handling OWASP Code Review Guide: Chapter on Error Handling]
* [https://www.owasp.org/index.php/Testing_for_configuration_management OWASP Testing Guide: Configuration Management]
* [https://www.owasp.org/index.php/Testing_for_Error_Code_(OWASP-IG-006) OWASP Testing Guide: Testing for Error Codes]
* [https://www.owasp.org/index.php/A10_2004_Insecure_Configuration_Management OWASP Top 10 2004 - Insecure Configuration Management ]

For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS ASVS requirements area for Security Configuration (V12)].

{{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
* [http://www.pcmag.com/article2/0,2817,11525,00.asp PC Magazine Article on Web Server Hardening]
* [http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]
* [http://benchmarks.cisecurity.org/downloads/benchmarks/ CIS Security Configuration Guides/Benchmarks]

{{Top_10_2013:BottomAdvancedTemplate
|type={{Top_10_2010:StyleTemplate}}
|usenext=2013NextLink
|next=A6-{{Top_10_2010:ByTheNumbers
|6
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A4-{{Top_10_2010:ByTheNumbers
|4
|year=2017
|language=en}}
|year=2017
|language=en
}}

@@ Line 27: / Line 27: @@
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Impacts: --->
-  Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise. The business impact depends on the protection needs of the application and data. </td>
+  Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise.<br/>The business impact depends on the protection needs of the application and data. </td>
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}
@@ Line 40: / Line 40: @@
 * The security settings in the application servers, application frameworks (e.g. Struts, Spring, ASP.NET), libraries, databases, etc. not set to secure values.
 * The server does not send security headers or directives or they are not set to secure values.
-* The software is out of date or vulnerable (see <b>A9:2017-Using Components with Known Vulnerabilities</b>).
+* The software is out of date or vulnerable (see <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=en|year=2017 }}_A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}} | A9:2017-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}]]</u></b>).
 Without a concerted, repeatable application security configuration process, systems are at a higher risk.
@@ Line 47: / Line 47: @@
 * A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically, with different credentials used in each environment. This process should be automated to minimize the effort required to setup a new secure environment.
 * A minimal platform without any unnecessary features, components, documentation, and samples. Remove or do not install unused features and frameworks.
-* A task to review and update the configurations appropriate to all security notes, updates and patches as part of the patch management process (see <b>A9:2017-Using Components with Known Vulnerabilities</b>). In particular, review cloud storage permissions (e.g. S3 bucket permissions).
+* A task to review and update the configurations appropriate to all security notes, updates and patches as part of the patch management process (see <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=en|year=2017 }}_A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}} | A9:2017-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}]]</u></b>). In particular, review cloud storage permissions (e.g. S3 bucket permissions).
 * A segmented application architecture that provides effective, secure separation between components or tenants, with segmentation, containerization, or cloud security groups (ACLs).
 * Sending security directives to clients, e.g. <u>[[OWASP_Secure_Headers_Project|Security Headers]]</u>.

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
-     |usenext=2013NextLink
+     |usenext=2017NextLink
-     |next=A6-{{Top_10_2010:ByTheNumbers
+     |next=A7-{{Top_10_2010:ByTheNumbers
-               |6
+               |7
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
-     |prev=A4-{{Top_10_2010:ByTheNumbers
+     |prev=A5-{{Top_10_2010:ByTheNumbers
-               |4
+               |5
                |year=2017
                |language=en}}
@@ Line 79: / Line 79: @@
 {{Top_10_2013:BottomAdvancedTemplate
      |type={{Top_10_2010:StyleTemplate}}
-     |usenext=2013NextLink
+     |usenext=2017NextLink
-     |next=A6-{{Top_10_2010:ByTheNumbers
+     |next=A7-{{Top_10_2010:ByTheNumbers
-               |6
+               |7
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
-     |prev=A4-{{Top_10_2010:ByTheNumbers
+     |prev=A5-{{Top_10_2010:ByTheNumbers
-               |4
+               |5
                |year=2017
                |language=en}}

← Older revision	Revision as of 22:45, 11 December 2017
(No difference)

@@ Line 38: / Line 38: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2017|language=en}}
 Is your application missing the proper security hardening across any part of the application stack? Including:
-# Is any of your software out of date? This software includes the OS, Web/App Server, DBMS, applications, APIs, and all components and libraries (see <u>[[Top 10 2017-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
+# Is any of your software out of date? This software includes the OS, Web/App Server, DBMS, applications, APIs, and all components and libraries (see <u>[[{{Top_10:LanguageFile|text=documentRootTop10|language=en|year=2017 }}-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
 # Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
 # Are default accounts and their passwords still enabled and unchanged?
@@ Line 49: / Line 49: @@
 The primary recommendations are to establish all of the following:
 # A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
-# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This process needs to include all components and libraries as well (see <u>[[Top 10 2017-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
+# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This process needs to include all components and libraries as well (see <u>[[{{Top_10:LanguageFile|text=documentRootTop10|language=en|year=2017 }}-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
 # A strong application architecture that provides effective, secure separation between components.
 # An automated process to verify that configurations and settings are properly configured in all environments.

@@ Line 18: / Line 18: @@
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Threat Agents: --->Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
+<!--- Threat Agents: --->Consider anonymous external attackers as well as authorized users that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Attack Vectors --->Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.
+<!--- Attack Vectors --->Attackers access default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.
 </td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Security Weakness --->Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
+<!--- Security Weakness --->Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, frameworks, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Technical Impacts --->The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.
+<!--- Technical Impacts --->Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Business Impacts  --->The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.
+<!--- Business Impacts  --->The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.
-Recovery costs could be expensive.</td>
+Recovery costs could be expensive.
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}
 {{Top_10:SubsectionTableBeginTemplate|type=main|year=2017}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2017|language=en}}
 Is your application missing the proper security hardening across any part of the application stack? Including:
-# Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
+# Is any of your software out of date? This software includes the OS, Web/App Server, DBMS, applications, APIs, and all components and libraries (see <u>[[Top 10 2017-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
 # Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
 # Are default accounts and their passwords still enabled and unchanged?
 # Does your error handling reveal stack traces or other overly informative error messages to users?
-# Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?
+# Are the security settings in your application servers, application frameworks (e.g., Struts, Spring, ASP.NET), libraries, databases, etc. not set to secure values?
 Without a concerted, repeatable application security configuration process, systems are at a higher risk.
@@ Line 53: / Line 49: @@
 The primary recommendations are to establish all of the following:
 # A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
-# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include '''all code libraries as well (see new A9)'''.
+# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This process needs to include all components and libraries as well (see <u>[[Top 10 2017-A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=en}}|2017-A9]]</u>).
 # A strong application architecture that provides effective, secure separation between components.
-# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
+# An automated process to verify that configurations and settings are properly configured in all environments.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2017|language=en}}
-'''Scenario #1:''' The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
+<u>'''Scenario #1:'''</u> The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
-'''Scenario #2:''' Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.
+<u>'''Scenario #3:'''</u> App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws such as framework versions that are known to be vulnerable.
-'''Scenario #3:''' App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
+<u>'''Scenario #4:'''</u> App server comes with sample applications that are not removed from your production server. These sample applications have well known security flaws attackers can use to compromise your server.
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2017|language=en}}
-{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
+{{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017|language=en}}
-* [https://www.owasp.org/index.php/Configuration  OWASP Development Guide: Chapter on Configuration]
+* <u>[[Configuration|OWASP Development Guide: Chapter on Configuration]]</u>
-* [https://www.owasp.org/index.php/Error_Handling  OWASP Code Review Guide: Chapter on Error Handling]
+* <u>[[Error_Handling|OWASP Code Review Guide: Chapter on Error Handling]]</u>
-* [https://www.owasp.org/index.php/Testing_for_configuration_management  OWASP Testing Guide: Configuration Management]
+* <u>[[Testing_for_configuration_management|OWASP Testing Guide: Configuration Management]]</u>
-* [https://www.owasp.org/index.php/Testing_for_Error_Code_(OWASP-IG-006)  OWASP Testing Guide: Testing for Error Codes]
+* <u>[[Testing_for_Error_Code_(OWASP-IG-006)|OWASP Testing Guide: Testing for Error Codes]]</u>
-* [https://www.owasp.org/index.php/A10_2004_Insecure_Configuration_Management  OWASP Top 10 2004 - Insecure Configuration Management ]
+* <u>[[A10_2004_Insecure_Configuration_Management|OWASP Top 10 2004 - Insecure Configuration Management]]</u>
-For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS  ASVS requirements area for Security Configuration (V12)].
+For additional requirements in this area, see the <u>[[ASVS|ASVS requirements areas for Security Configuration (V11 and V19)]]</u>.
-{{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
+{{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
-* [http://www.pcmag.com/article2/0,2817,11525,00.asp  PC Magazine Article on Web Server Hardening]
+* <u>[http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-123.pdf NIST Guide to General Server Hardening]</u>
-* [http://cwe.mitre.org/data/definitions/2.html  CWE Entry 2 on Environmental Security Flaws]
+* <u>[https://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]</u>
-* [http://benchmarks.cisecurity.org/downloads/benchmarks/  CIS Security Configuration Guides/Benchmarks]
+* <u>[https://benchmarks.cisecurity.org/downloads/benchmarks/ CIS Security Configuration Guides/Benchmarks]</u>
 {{Top_10_2013:BottomAdvancedTemplate