#5
A05:2021
Security Misconfiguration
The application might be vulnerable if it is missing appropriate security hardening or has improperly configured permissions on cloud services.
概述
Moving up from #6, 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it's not surprising to see this category move up.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Default credentials
Administrative interfaces or services are left with default usernames and passwords that are publicly known.
检测信号:
Login attempts using common default credential pairs
Verbose error messages
Detailed error messages expose internal paths, stack traces, or database schemas to attackers.
检测信号:
Error responses containing internal file paths, SQL queries, or stack traces
Unnecessary services
Debug endpoints, sample applications, or development features are left enabled in production.
检测信号:
Access to debug endpoints, phpinfo pages, or development tooling
如何预防
- Implement a repeatable hardening process for fast, secure deployment
- Remove or do not install unused features and frameworks
- Review and update configurations appropriate to all security notes
- Use segmented application architecture for effective separation
- Send security directives to clients (Security Headers)
- Automate verification of configurations in all environments
有Shoulder检测的CWE (6)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
CWE-942
9 规则
Permissive Cross-domain Policy with Untrusted Domains
python, go
CWE-611
3 规则
Improper Restriction of XML External Entity Reference
go, javascript, typescript, python
CWE-547
2 规则
Use of Hard-coded, Security-relevant Constants
javascript, typescript, python
CWE-614
2 规则
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
python
CWE-16
1 规则
Configuration
python
CWE-526
1 规则
Cleartext Storage of Sensitive Information in an Environment Variable
go
其他映射的CWE (14)
这些CWE映射到此类别，但尚无Shoulder规则。