This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Top 10 2010-A6-Security Misconfiguration"

From OWASP
Jump to: navigation, search
 
(10 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
{{Top_10_2010:TopTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=A5-Cross-Site Request Forgery (CSRF)|next=A7-Insecure Cryptographic Storage}}
 
{{Top_10_2010:TopTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=A5-Cross-Site Request Forgery (CSRF)|next=A7-Insecure Cryptographic Storage}}
<center>
+
{{Top_10_2010:SummaryTableHeaderBeginTemplate}}
{| style="align:center; text-align:center; border:2px solid #4F81BD; background-color:#F2F2F2; padding=2;"
+
{{Top_10_2010:SummaryTableValue-1-Template|Exploitability|EASY}}
|- style="background-color: #4F81Bd; color: #000000;"
+
{{Top_10_2010:SummaryTableValue-2-Template|Prevalence|COMMON}}
! Threat Agents !! Attack Vectors
+
{{Top_10_2010:SummaryTableValue-1-Template|Detectability|EASY}}
! colspan="2" | Security Weakness
+
{{Top_10_2010:SummaryTableValue-2-Template|Impact|MODERATE}}
! Technical Impact
+
{{Top_10_2010:SummaryTableHeaderEndTemplate}}
! Business Impacts
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.</td>
|-
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.</td>
| style="background-color: #D9D9D9; color: #000000;" | ______
+
    <td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, framework, and custom code. Developers and network administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.</td>
| style="background-color: #FF0000; color: #000000;" | Exploitability<br>EASY
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise.</td>
| style="background-color: #FFB200; color: #000000;" | Prevalence<br>COMMON
+
    <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.<br/><br/>Recovery costs could be expensive.</td>
| style="background-color: #FF0000; color: #000000;" | Detectability<br>EASY
+
{{Top_10_2010:SummaryTableEndTemplate}}
| style="background-color: #FFB200; color: #000000;" | Impact<br>MODERATE
 
| style="background-color: #D9D9D9; color: #000000;" | ______
 
|-
 
| style="text-align: left; border: 2px solid #FFFFFF;" | Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions.
 
| style="text-align: left; border: 2px solid #FFFFFF;" | Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system.
 
| colspan="2" style="text-align: left;border: 2px solid #FFFFFF;" | Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, framework, and custom code. Developers and network administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
 
| style="text-align: left; border: 2px solid #FFFFFF;" | Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise.
 
| style="text-align: left; border: 2px solid #FFFFFF;" | The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.
 
  
Recovery costs could be expensive.
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=6}}
|}
 
</center>
 
 
 
{{Top_10_2010:SubsectionVulnerableTemplate|Security Misconfiguration|
 
 
Have you performed the proper security hardening across the entire application stack?
 
Have you performed the proper security hardening across the entire application stack?
 
# Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries.
 
# Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries.
Line 34: Line 22:
  
 
A concerted, repeatable process is required to develop and maintain a proper application security configuration.
 
A concerted, repeatable process is required to develop and maintain a proper application security configuration.
}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=2|risk=6}}
 
 
{{Top_10_2010:SubsectionPreventionTemplate|Security Misconfiguration|
 
 
The primary recommendations are to establish all of the following:
 
The primary recommendations are to establish all of the following:
 
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically. This process should be automated to minimize the effort required to setup a new secure environment.
 
# A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically. This process should be automated to minimize the effort required to setup a new secure environment.
Line 42: Line 28:
 
# A strong application architecture that provides good separation and security between components.
 
# A strong application architecture that provides good separation and security between components.
 
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
 
# Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=6}}
 
+
<u>Scenario #1</u>: Your application relies on a powerful framework like Struts or Spring. XSS flaws are found in these framework components you rely on. An update is released to fix these flaws but you don’t update your libraries. Until you do, attackers can easily find and exploit these flaws in your app.
{{Top_10_2010:SubsectionExampleTemplate|Security Misconfiguration|
 
<u>Scenario #1</u>: Your application relies on a powerful framework like Struts or Spring. XSS flaws are found in these framework components you rely on. An update is released to fix these flaws but you don’t update your libraries. Until you do, attackers can easily find and exploit these flaw in your app.
 
  
 
<u>Scenario #2</u>: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
 
<u>Scenario #2</u>: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.
  
<u>Scenario #3</u>: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she reverses to get all your custom code. She then find a serious access control flaw in your application.
+
<u>Scenario #3</u>: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.
  
 
<u>Scenario #4</u>: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
 
<u>Scenario #4</u>: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.
}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=6}}
 
 
{{Top_10_2010:SubsectionReferencesTemplate|Security Misconfiguration}}
 
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
* [http://www.owasp.org/index.php/Configuration OWASP Development Guide: Chapter on Configuration]
+
* [[Configuration | OWASP Development Guide: Chapter on Configuration]]
* [http://www.owasp.org/index.php/Error_Handling OWASP Code Review Guide: Chapter on Error Handling]
+
* [[Error_Handling | OWASP Code Review Guide: Chapter on Error Handling]]
* [http://www.owasp.org/index.php/Testing_for_configuration_management OWASP Testing Guide: Configuration Management]
+
* [[Testing_for_configuration_management | OWASP Testing Guide: Configuration Management]]
* [http://www.owasp.org/index.php/Testing_for_Error_Code_(OWASP-IG-006) OWASP Testing Guide: Testing for Error Codes]
+
* [[Testing_for_Error_Code_(OWASP-IG-006) | OWASP Testing Guide: Testing for Error Codes]]
* [http://www.owasp.org/index.php/A10_2004_Insecure_Configuration_Management OWASP Top 10 2004 - Insecure Configuration Management]
+
* [[A10_2004_Insecure_Configuration_Management | OWASP Top 10 2004 - Insecure Configuration Management]]
  
 
For additional requirements in this area, see the [http://www.owasp.org/index.php/ASVS#tab=Download ASVS requirements area for Security Configuration (V12)]
 
For additional requirements in this area, see the [http://www.owasp.org/index.php/ASVS#tab=Download ASVS requirements area for Security Configuration (V12)]
Line 68: Line 50:
 
*[http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]
 
*[http://cwe.mitre.org/data/definitions/2.html CWE Entry 2 on Environmental Security Flaws]
 
*[http://cisecurity.org/en-us/?route=downloads.benchmarks CIS Security Configuration Guides/Benchmarks]
 
*[http://cisecurity.org/en-us/?route=downloads.benchmarks CIS Security Configuration Guides/Benchmarks]
{{Top_10_2010:BottomTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=A5-Cross-Site Request Forgery (CSRF)|next=A7-Insecure Cryptographic Storage}}
+
{{Top_10_2010:BottomAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|useprev=2010PrevLink|usenext=2010NextLink|prev=A5-Cross-Site Request Forgery (CSRF)|next=A7-Insecure Cryptographic Storage}}
 +
 
 +
[[Category:OWASP Top Ten Project]]

Latest revision as of 20:11, 14 June 2010

NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.

← A5-Cross-Site Request Forgery (CSRF)
Top 10 Introduction
Top 10 Risks
A7-Insecure Cryptographic Storage →
Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts
Application Specific Exploitability
EASY
Prevalence
COMMON
Detectability
EASY
Impact
MODERATE
Application / Business Specific
Consider anonymous external attackers as well as users with their own accounts that may attempt to compromise the system. Also consider insiders wanting to disguise their actions. Attacker accesses default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access to or knowledge of the system. Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, framework, and custom code. Developers and network administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such flaws result in a complete system compromise. The system could be completely compromised without you knowing it. All your data could be stolen or modified slowly over time.

Recovery costs could be expensive.
Am I Vulnerable To 'Security Misconfiguration'?

Have you performed the proper security hardening across the entire application stack?

  1. Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries.
  2. Is everything unnecessary disabled, removed, or not installed (e.g. ports, services, pages, accounts, privileges)?
  3. Are default account passwords changed or disabled?
  4. Is your error handling set up to prevent stack traces and other overly informative error messages from leaking?
  5. Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries understood and configured properly?

A concerted, repeatable process is required to develop and maintain a proper application security configuration.

How Do I Prevent 'Security Misconfiguration'?

The primary recommendations are to establish all of the following:

  1. A repeatable hardening process that makes it fast and easy to deploy another environment that is properly locked down. Development, QA, and production environments should all be configured identically. This process should be automated to minimize the effort required to setup a new secure environment.
  2. A process for keeping abreast of and deploying all new software updates and patches in a timely manner to each deployed environment. This needs to include all code libraries as well, which are frequently overlooked.
  3. A strong application architecture that provides good separation and security between components.
  4. Consider running scans and doing audits periodically to help detect future misconfigurations or missing patches.
Example Attack Scenarios

Scenario #1: Your application relies on a powerful framework like Struts or Spring. XSS flaws are found in these framework components you rely on. An update is released to fix these flaws but you don’t update your libraries. Until you do, attackers can easily find and exploit these flaws in your app.

Scenario #2: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.

Scenario #3: Directory listing is not disabled on your server. Attacker discovers she can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which she reverse engineers to get all your custom code. She then finds a serious access control flaw in your application.

Scenario #4: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.

References

OWASP

For additional requirements in this area, see the ASVS requirements area for Security Configuration (V12)

External

← A5-Cross-Site Request Forgery (CSRF)
Top 10 Introduction
Top 10 Risks
A7-Insecure Cryptographic Storage →

© 2002-2010 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved. CC-by-sa-3 0-88x31.png