This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10 2013-A5-Security Misconfiguration"
From OWASP
(Changed use of Template 'Top_10_2010:SubsectionAdvancedTemplate': Replace Parameter 'number' by 'subsection' and 'position') |
(added 'Top_10:SummaryTableTemplate' to get this section easier and to get better prepared for internationalisation. + added '|language=en' to get better prepared for internationalisation.) |
||
| Line 3: | Line 3: | ||
|next={{Top_10_2010:ByTheNumbers | |next={{Top_10_2010:ByTheNumbers | ||
|6 | |6 | ||
| − | |year=2013}} | + | |year=2013 |
| + | |language=en}} | ||
|useprev=2013PrevLink | |useprev=2013PrevLink | ||
|prev={{Top_10_2010:ByTheNumbers | |prev={{Top_10_2010:ByTheNumbers | ||
|4 | |4 | ||
| − | |year=2013}} | + | |year=2013 |
| + | |language=en}} | ||
}} | }} | ||
| − | {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013}} | + | {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}} |
| − | {{ | + | {{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=1|impact=2|year=2013|language=en}} |
| − | |||
| − | |||
| − | |||
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}} | {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}} | ||
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. | <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. | ||
| Line 29: | Line 28: | ||
{{Top_10_2010:SummaryTableEndTemplate}} | {{Top_10_2010:SummaryTableEndTemplate}} | ||
| − | {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2013}} | + | {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2013|language=en}} |
Have you performed the proper security hardening across the entire application stack? | Have you performed the proper security hardening across the entire application stack? | ||
#Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9). | #Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9). | ||
| Line 37: | Line 36: | ||
#Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries understood and configured properly? | #Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries understood and configured properly? | ||
A concerted, repeatable process is required to develop and maintain a proper application security configuration. | A concerted, repeatable process is required to develop and maintain a proper application security configuration. | ||
| − | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=5|year=2013}} | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=5|year=2013|language=en}} |
The primary recommendations are to establish all of the following: | The primary recommendations are to establish all of the following: | ||
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically. This process should be automated to minimize the effort required to setup a new secure environment. | # A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically. This process should be automated to minimize the effort required to setup a new secure environment. | ||
| Line 43: | Line 42: | ||
# A strong application architecture that provides good separation and security between components. | # A strong application architecture that provides good separation and security between components. | ||
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches. | # Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches. | ||
| − | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2013}} | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2013|language=en}} |
<u>Scenario #1:</u> The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over. | <u>Scenario #1:</u> The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over. | ||
| Line 51: | Line 50: | ||
<u>Scenario #4:</u> App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server. | <u>Scenario #4:</u> App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server. | ||
| − | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2013}} | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2013|language=en}} |
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | ||
* [https://www.owasp.org/index.php/Configuration OWASP Development Guide: Chapter on Configuration] | * [https://www.owasp.org/index.php/Configuration OWASP Development Guide: Chapter on Configuration] | ||
| Line 61: | Line 60: | ||
For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS ASVS requirements area for Security Configuration (V12)]. | For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS ASVS requirements area for Security Configuration (V12)]. | ||
| − | {{Top_10_2010:SubSubsectionExternalReferencesTemplate}} | + | {{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}} |
* [http://www.pcmag.com/article2/0,2817,11525,00.asp PC Magazine Article on Web Server Hardening] | * [http://www.pcmag.com/article2/0,2817,11525,00.asp PC Magazine Article on Web Server Hardening] | ||
* [http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws] | * [http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws] | ||
| Line 71: | Line 70: | ||
|next={{Top_10_2010:ByTheNumbers | |next={{Top_10_2010:ByTheNumbers | ||
|6 | |6 | ||
| − | |year=2013}} | + | |year=2013 |
| + | |language=en}} | ||
|useprev=2013PrevLink | |useprev=2013PrevLink | ||
|prev={{Top_10_2010:ByTheNumbers | |prev={{Top_10_2010:ByTheNumbers | ||
|4 | |4 | ||
| − | |year=2013}}}} | + | |year=2013 |
| + | |language=en}} | ||
| + | }} | ||
Revision as of 11:36, 9 June 2013
NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.
| [[Top 10 {{{year}}}-Insecure Direct Object References|← Insecure Direct Object References]] | [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]] |
[[Top 10 {{{year}}}-Sensitive Data Exposure|Sensitive Data Exposure →]] |
| Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts | |
|---|---|---|---|---|---|
| Application Specific | Exploitability EASY |
Prevalence COMMON |
Detectability EASY |
Impact MODERATE |
Application / Business Specific |
| Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. . | Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. | Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, framework, and custom code. Developers and network administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. | Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise. | The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time. Recovery costs could be expensive. | |
|
Am I Vulnerable To 'Security Misconfiguration'?
Have you performed the proper security hardening across the entire application stack?
A concerted, repeatable process is required to develop and maintain a proper application security configuration. |
How Do I Prevent 'Security Misconfiguration'?
The primary recommendations are to establish all of the following:
|
|
Example Attack Scenarios
Scenario #1: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over. Scenario #2: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she reverses to get all your custom code. She then finds a serious access control flaw in your application. Scenario #3: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide. Scenario #4: App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server. |
References
OWASP
For additional requirements in this area, see the ASVS requirements area for Security Configuration (V12). External |
| [[Top 10 {{{year}}}-Insecure Direct Object References|← Insecure Direct Object References]] | [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]] |
[[Top 10 {{{year}}}-Sensitive Data Exposure|Sensitive Data Exposure →]] |
