This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Top 10 2013-A5-Security Misconfiguration"

From OWASP
Jump to: navigation, search
m (deleted a '#' in Am I Vulerable...; added several '#' at 'How Do I prevent...')
 
(12 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
= TEMPORARY PLACEHOLDER for 2013 T10 =
 
 
{{Top_10_2013:TopTemplate
 
{{Top_10_2013:TopTemplate
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
−
     |next={{Top_10_2010:ByTheNumbers
+
     |next=A6-{{Top_10_2010:ByTheNumbers
 
               |6
 
               |6
−
               |year=2013}}
+
               |year=2013
 +
              |language=en}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
−
     |prev={{Top_10_2010:ByTheNumbers
+
     |prev=A4-{{Top_10_2010:ByTheNumbers
 
               |4
 
               |4
−
               |year=2013}}
+
               |year=2013
 +
              |language=en}}
 +
    |year=2013
 +
    |language=en
 
}}
 
}}
  
−
{{Top_10:SummaryTableValues
+
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
−
    |DIFFICULT|#FFFF00
+
{{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=1|impact=2|year=2013|language=en}}
−
    |UNCOMMON|#FFFF00
+
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
−
    |AVERAGE|#FFC000
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
−
    |SEVERE|#FF0000
+
Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
−
    |year=2013
+
</td>
−
}}
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 +
Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.
 +
 
 +
</td>
 +
    <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 +
Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
 +
 
 +
</td>
 +
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 +
The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.
 +
 
 +
Recovery costs could be expensive
 +
 
 +
</td>
 +
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>
 +
The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.
  
−
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
+
Recovery costs could be expensive.</td>
−
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>blank.</td>
 
−
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>blank</td>
 
−
    <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>blank</td>
 
−
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>blank</td>
 
−
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>blank</td>
 
 
{{Top_10_2010:SummaryTableEndTemplate}}
 
{{Top_10_2010:SummaryTableEndTemplate}}
  
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=5|year=2013}}
+
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=5|year=2013|language=en}}
−
blank
+
Is your application missing the proper security hardening across any part of the application stack? Including:
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=2|risk=5|year=2013}}
+
# Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
−
blank
+
# Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
−
#blankBullet1
+
# Are default accounts and their passwords still enabled and unchanged?
−
#blankBullet2
+
# Does your error handling reveal stack traces or other overly informative error messages to users?
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=5|year=2013}}
+
# Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?
−
blank
+
 
−
{{Top_10_2010:ExampleBeginTemplate}}<span style="color:red;">blank code</span>{{Top_10_2010:ExampleEndTemplate}}
+
Without a concerted, repeatable application security configuration process, systems are at a higher risk.
−
blank
+
 
−
{{Top_10_2010:ExampleBeginTemplate}}<nowiki>http://example.com/app/accountView?id=</nowiki><span style="color: red;">' or '1'='1</span>{{Top_10_2010:ExampleEndTemplate}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=5|year=2013|language=en}}
−
blank
+
The primary recommendations are to establish all of the following:
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=5|year=2013}}
+
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
 +
# A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include '''all code libraries as well (see new A9)'''.
 +
# A strong application architecture that provides effective, secure separation between components.
 +
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
 +
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=5|year=2013|language=en}}
 +
'''Scenario #1:''' The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
 +
 
 +
'''Scenario #2:''' Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.
 +
 
 +
'''Scenario #3:''' App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
 +
 
 +
'''Scenario #4:''' App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server.
 +
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=5|year=2013|language=en}}
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
−
* [[SQL_Injection_Prevention_Cheat_Sheet | OWASP SQL Injection Prevention Cheat Sheet]]
+
* [https://www.owasp.org/index.php/Configuration  OWASP Development Guide: Chapter on Configuration]
−
* [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Encoder.html ESAPI Encoder API]
+
* [https://www.owasp.org/index.php/Error_Handling  OWASP Code Review Guide: Chapter on Error Handling]
−
{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}
+
* [https://www.owasp.org/index.php/Testing_for_configuration_management  OWASP Testing Guide: Configuration Management]
−
* [http://cwe.mitre.org/data/definitions/77.html CWE Entry 77 on Command Injection]
+
* [https://www.owasp.org/index.php/Testing_for_Error_Code_(OWASP-IG-006)  OWASP Testing Guide: Testing for Error Codes]
−
* [http://cwe.mitre.org/data/definitions/89.html CWE Entry 89 on SQL Injection]
+
* [https://www.owasp.org/index.php/A10_2004_Insecure_Configuration_Management  OWASP Top 10 2004 - Insecure Configuration Management ]
 +
 
 +
For additional requirements in this area, see the [https://www.owasp.org/index.php/ASVS  ASVS requirements area for Security Configuration (V12)].
 +
 
 +
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|language=en}}
 +
* [http://www.pcmag.com/article2/0,2817,11525,00.asp  PC Magazine Article on Web Server Hardening]
 +
* [http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]
 +
* [http://benchmarks.cisecurity.org/downloads/benchmarks/ CIS Security Configuration Guides/Benchmarks]
  
 
{{Top_10_2013:BottomAdvancedTemplate
 
{{Top_10_2013:BottomAdvancedTemplate
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
−
     |next={{Top_10_2010:ByTheNumbers
+
     |next=A6-{{Top_10_2010:ByTheNumbers
 
               |6
 
               |6
−
               |year=2013}}
+
               |year=2013
 +
              |language=en}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
−
     |prev={{Top_10_2010:ByTheNumbers
+
     |prev=A4-{{Top_10_2010:ByTheNumbers
 
               |4
 
               |4
−
               |year=2013}}}}
+
               |year=2013
−
 
+
              |language=en}}
−
[[Category:OWASP Top Ten Project]]
+
    |year=2013
 +
    |language=en
 +
}}

Latest revision as of 20:58, 23 June 2013

NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.

← A4-Insecure Direct Object References
2013 Table of Contents

2013 Top 10 List

A6-Sensitive Data Exposure →
Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts
Application Specific Exploitability
EASY		 Prevalence
COMMON		 Detectability
EASY		 Impact
MODERATE		 Application / Business Specific

Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.

Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.

Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.

The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time.

Recovery costs could be expensive

The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.

Recovery costs could be expensive.
Am I Vulnerable To 'Security Misconfiguration'?

Is your application missing the proper security hardening across any part of the application stack? Including:

  1. Is any of your software out of date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries (see new A9).
  2. Are any unnecessary features enabled or installed (e.g., ports, services, pages, accounts, privileges)?
  3. Are default accounts and their passwords still enabled and unchanged?
  4. Does your error handling reveal stack traces or other overly informative error messages to users?
  5. Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values?

Without a concerted, repeatable application security configuration process, systems are at a higher risk.

How Do I Prevent 'Security Misconfiguration'?

The primary recommendations are to establish all of the following:

  1. A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically (with different passwords used in each environment). This process should be automated to minimize the effort required to setup a new secure environment.
  2. A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include all code libraries as well (see new A9).
  3. A strong application architecture that provides effective, secure separation between components.
  4. Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
Example Attack Scenarios

Scenario #1: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.

Scenario #2: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.

Scenario #3: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.

Scenario #4: App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server.

References

OWASP

For additional requirements in this area, see the ASVS requirements area for Security Configuration (V12).

External

← A4-Insecure Direct Object References
2013 Table of Contents

2013 Top 10 List

A6-Sensitive Data Exposure →
© 2002-2013 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved. CC-by-sa-3 0-88x31.png
Retrieved from "https://wiki.owasp.org/index.php?title=Top_10_2013-A5-Security_Misconfiguration&oldid=154338"