This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10-2017 A6-Security Misconfiguration"
(Launch the new page for Top 10 2017-A5-Security Misconfiguration (RC1) with content of 2013-A5 as a reference to compare changes) |
m (Added some comments in Wiki source code of the SummaryTable Header (SummaryTableRowStyleTemplates)) |
||
Line 18: | Line 18: | ||
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}} | {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}} | ||
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
− | Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. | + | <!--- Threat Agents: --->Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. |
</td> | </td> | ||
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
− | Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. | + | <!--- Attack Vectors --->Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. |
</td> | </td> | ||
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | <td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
− | Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. | + | <!--- Security Weakness --->Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. |
</td> | </td> | ||
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
− | The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time. | + | <!--- Technical Impacts --->The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time. |
Recovery costs could be expensive | Recovery costs could be expensive | ||
Line 35: | Line 35: | ||
</td> | </td> | ||
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
− | The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time. | + | <!--- Business Impacts --->The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time. |
Recovery costs could be expensive.</td> | Recovery costs could be expensive.</td> |
Revision as of 22:17, 22 April 2017
Threat Agents / Attack Vectors | Security Weakness | Impacts | |||
---|---|---|---|---|---|
App Specific | Exploitability EASY |
Prevalence COMMON |
Detectability EASY |
Impact MODERATE |
Business ? |
Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. |
Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. |
Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. |
The system could be completely compromised without you knowing it. All of your data could be stolen or modified slowly over time. Recovery costs could be expensive |
The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time. Recovery costs could be expensive. |
Am I Vulnerable To 'Broken Access Control'?
Is your application missing the proper security hardening across any part of the application stack? Including:
Without a concerted, repeatable application security configuration process, systems are at a higher risk. |
How Do I Prevent 'Broken Access Control'?
The primary recommendations are to establish all of the following:
|
Example Attack Scenarios
Scenario #1: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over. Scenario #2: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she decompiles and reverse engineers to get all your custom code. She then finds a serious access control flaw in your application. Scenario #3: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide. Scenario #4: App server comes with sample applications that are not removed from your production server. Said sample applications have well known security flaws attackers can use to compromise your server. |
References
OWASP
For additional requirements in this area, see the ASVS requirements area for Security Configuration (V12). External |