Security Misconfiguration

What it is

Security misconfiguration is the most common vulnerability in OWASP Top 10. It includes using default credentials, enabling unnecessary features, using permissive configurations, missing security headers, verbose error messages exposing stack traces, and exposed administration interfaces.

Attack Vectors

• Web server and application framework configuration
• Cloud storage bucket permissions
• Database service exposed to internet
• Admin panel accessible without authentication
• Directory listing enabled on web server
• Debug/verbose error pages in production

Testing Methodology

1. Test default credentials on admin panels, databases, and services
2. Check for exposed .git/, .env, backup files at common paths
3. Verify security headers are set (CSP, HSTS, X-Frame-Options)
4. Test for directory listing on web server
5. Check for verbose error messages revealing stack traces

Indicators of Vulnerability

• Default credentials accepted on admin interfaces
• Sensitive files (.env, .git) accessible via HTTP
• Stack traces or verbose error messages in responses
• Missing security headers in HTTP responses

Detection Guidance

Run automated configuration scanners (Nikto, nuclei) regularly. Audit cloud storage bucket permissions. Monitor for requests to sensitive paths.

Mitigation & Remediation

• Change all default credentials immediately after deployment
• Disable or remove all unnecessary features and services
• Apply security hardening guides for all components
• Implement all recommended security headers
• Never expose detailed error messages or stack traces to users
• Restrict admin interfaces to trusted IP ranges

References

• OWASP Security Misconfiguration
• OWASP Configuration Cheat Sheet
• OWASP Hunting — Security Misconfiguration (upstream)