Security Misconfiguration | vuln-scout

Stats

Actions

Tags

Security Misconfiguration | vuln-scout

Security Misconfiguration (OWASP A05)

Purpose

Provide detection patterns for security misconfiguration vulnerabilities including default credentials, debug mode exposure, missing security headers, and insecure TLS settings.

OWASP Top 10 Mapping

Category: A05 - Security Misconfiguration

CWEs:

CWE-16: Configuration
CWE-209: Information Exposure Through Error Messages
CWE-215: Information Exposure Through Debug Information
CWE-548: Information Exposure Through Directory Listing
CWE-756: Missing Custom Error Page

When to Use

Activate this skill when:

Reviewing application configuration files
Checking for exposed debug/admin endpoints
Auditing security header implementation
Verifying TLS/SSL configuration
Looking for default or weak credentials

Debug Mode Enabled

Detection Patterns

Python (Django/Flask)

# Django debug mode
grep -rniE "DEBUG\s*=\s*True" --include="*.py" --include="settings.py"

# Flask debug mode
grep -rniE "app\.debug\s*=\s*True|FLASK_DEBUG|debug=True" --include="*.py"

# Environment files
grep -rniE "DEBUG=1|DEBUG=true|DEBUG=True" --include="*.env" --include=".env*"

Java (Spring)

# Spring DevTools / Debug
grep -rniE "spring\.devtools|management\.endpoints\.web\.exposure|actuator" --include="*.properties" --include="*.yaml" --include="*.yml"

# Exposed actuator endpoints
grep -rniE "exposure\.include.*\*|exposure\.include.*health,info,env" --include="*.properties" --include="*.yaml"

PHP

# Display errors
grep -rniE "display_errors.*On|display_errors.*1|error_reporting.*E_ALL" --include="*.php" --include="php.ini"

# Laravel debug
grep -rniE "APP_DEBUG=true|'debug'.*=>.*true" --include="*.env" --include="*.php"

Go

# Gin debug mode
grep -rniE "gin\.SetMode.*gin\.DebugMode|GIN_MODE=debug" --include="*.go" --include="*.env"

# pprof enabled
grep -rniE "net/http/pprof|/debug/pprof" --include="*.go"

TypeScript/Node.js

# Debug environment
grep -rniE "NODE_ENV.*development|DEBUG=\*|debug.*true" --include="*.ts" --include="*.js" --include="*.env"

Default Credentials

Detection Patterns

# Common default passwords
grep -rniE "password.*['\"]admin['\"]|password.*['\"]123456['\"]|password.*['\"]password['\"]|password.*['\"]root['\"]|password.*['\"]test['\"]" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Default usernames with passwords
grep -rniE "admin.*admin|root.*root|user.*password|test.*test" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php" --include="*.env" --include="*.yaml"

# Database defaults
grep -rniE "postgres.*postgres|mysql.*root|mongodb.*admin" --include="*.env" --include="*.yaml" --include="*.properties"

Common Default Credentials to Check

Service	Username	Password
PostgreSQL	postgres	postgres
MySQL	root	(empty)
MongoDB	admin	admin
Redis	(none)	(none)
RabbitMQ	guest	guest
Elasticsearch	elastic	changeme
Jenkins	admin	admin
Grafana	admin	admin

Exposed Admin/Debug Endpoints

Detection Patterns

# Admin routes
grep -rniE "[\"\'/]admin|[\"\'/]_admin|[\"\'/]administrator" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Debug/Dev endpoints
grep -rniE "[\"\'/]debug|[\"\'/]_debug|[\"\'/]dev|[\"\'/]test" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Internal endpoints
grep -rniE "[\"\'/]internal|[\"\'/]private|[\"\'/]system" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Monitoring endpoints
grep -rniE "[\"\'/]metrics|[\"\'/]health|[\"\'/]status|[\"\'/]actuator|[\"\'/]swagger|[\"\'/]graphql" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Framework-Specific Endpoints

Framework	Endpoint	Risk
Spring Boot	/actuator/*	Env vars, heap dump
Django	/admin/	Admin panel
Rails	/rails/info	Version disclosure
Laravel	/telescope	Debug info
Express	/graphql	Introspection
Go pprof	/debug/pprof	Memory/CPU profiling

Missing Security Headers

Detection Patterns

# Look for header setting code
grep -rniE "Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Strict-Transport-Security|X-XSS-Protection" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Middleware/interceptor configuration
grep -rniE "helmet|securityHeaders|addHeader|setHeader.*security" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Required Security Headers

Header	Value	Purpose
Content-Security-Policy	`default-src 'self'`	Prevent XSS
X-Frame-Options	`DENY`	Prevent clickjacking
X-Content-Type-Options	`nosniff`	Prevent MIME sniffing
Strict-Transport-Security	`max-age=31536000`	Force HTTPS
X-XSS-Protection	`1; mode=block`	XSS filter (legacy)
Referrer-Policy	`strict-origin-when-cross-origin`	Control referrer
Permissions-Policy	`geolocation=()`	Limit browser features

TLS/SSL Misconfiguration

Detection Patterns

# Insecure TLS versions
grep -rniE "SSLv2|SSLv3|TLSv1\.0|TLSv1\.1|ssl\.PROTOCOL_SSLv|TLS_RSA_" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Disabled certificate verification
grep -rniE "verify.*false|InsecureSkipVerify.*true|VERIFY_NONE|verify_ssl.*False|rejectUnauthorized.*false" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Weak ciphers
grep -rniE "DES|RC4|MD5|NULL|EXPORT|anon" --include="*.go" --include="*.py" --include="*.java" --include="*.conf"

Secure TLS Configuration

Minimum: TLS 1.2 Recommended: TLS 1.3

Safe cipher suites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

Directory Listing

Detection Patterns

# Nginx
grep -rniE "autoindex\s+on" --include="*.conf" --include="nginx.conf"

# Apache
grep -rniE "Options.*Indexes|DirectoryIndex" --include="*.conf" --include=".htaccess"

# Application-level
grep -rniE "directory.*listing|listFiles|readdir" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Proxy Cache Misconfiguration

Overview

Proxy caches (Nginx, Varnish, CDN) can expose sensitive data if:

Authenticated responses are cached based on file extension
Cache key doesn't include session/auth identifiers
Dynamic paths are cached as static content

See also: cache-poisoning skill for comprehensive cache attack patterns.

Detection Patterns

# Nginx proxy cache configuration
grep -rniE "proxy_cache|proxy_cache_valid|proxy_cache_key" --include="*.conf" --include="nginx.conf"

# CRITICAL: Cache rules for static extensions on dynamic paths
grep -rniE "location.*\.(css|js|png|jpg|jpeg|gif|ico|svg)" -A10 --include="*.conf" | grep -iE "proxy_cache|cache"

# Missing cache bypass for authenticated requests
grep -rniE "proxy_cache_bypass|proxy_no_cache" --include="*.conf"

# Varnish cache rules
grep -rniE "vcl_recv|vcl_hash|set beresp\.ttl" --include="*.vcl"

Security Checklist

Authenticated responses excluded from cache (proxy_cache_bypass $http_authorization)
Cache key includes user identifier for personalized content
Cache-Control: private set for authenticated endpoints
Vary: Authorization header used appropriately

CORS Misconfiguration

Detection Patterns

# Wildcard origin
grep -rniE "Access-Control-Allow-Origin.*\*|AllowAllOrigins|cors.*origin.*\*" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Dynamic origin reflection (vulnerable)
grep -rniE "Origin.*header|request\.headers\.origin|getHeader.*Origin" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Credentials with wildcard (invalid but attempted)
grep -rniE "Access-Control-Allow-Credentials.*true" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Verbose Error Messages

Detection Patterns

# Stack traces in responses
grep -rniE "printStackTrace|traceback|\.stack|debug.*true.*error" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Detailed error responses
grep -rniE "error.*message.*\+|err\.Error\(\)|e\.getMessage\(\)" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Unnecessary Features Enabled

Detection Patterns

# HTTP methods (should disable unused)
grep -rniE "TRACE|OPTIONS|PUT|DELETE" --include="*.conf" --include="*.xml"

# Unused ports
grep -rniE "listen.*22|listen.*21|listen.*3306|listen.*5432" --include="*.conf" --include="*.yaml"

# Development dependencies in production
grep -rniE "devDependencies|dev-dependencies" --include="package.json" --include="Cargo.toml"

Framework-Specific Checks

Django

grep -rniE "DEBUG|SECRET_KEY|ALLOWED_HOSTS.*\*|CSRF_COOKIE_SECURE.*False|SESSION_COOKIE_SECURE.*False" --include="settings.py"

Spring Boot

grep -rniE "management\.endpoints|spring\.datasource\.password|server\.error\.include-stacktrace" --include="*.properties" --include="*.yaml"

Express/Node.js

grep -rniE "trust proxy|x-powered-by|helmet|NODE_ENV" --include="*.ts" --include="*.js"

Laravel

grep -rniE "APP_DEBUG|APP_KEY|MAIL_PASSWORD|DB_PASSWORD" --include=".env" --include="*.php"

Verification Checklist

CWE References

CWE	Name	Example
CWE-16	Configuration	Insecure default settings
CWE-209	Error Info Exposure	Stack traces to users
CWE-215	Debug Info Exposure	Debug endpoints accessible
CWE-524	Sensitive Info in Cache	Authenticated data cached by proxy
CWE-548	Directory Listing	autoindex on
CWE-756	Missing Error Page	Default error pages