A05:2021 - Security Misconfiguration
This broad category represents vulnerabilities arising from poor system hardening, unpatched systems, or unnecessary features being enabled.
Common Misconfigurations
- Default Credentials: Leaving default usernames and passwords enabled (e.g., 'admin'/'admin').
- Directory Listing: Web servers accidentally allowing users to browse the entire directory structure (exposing configuration files, source code, or backups).
- Unnecessary Services: Having non-essential services (like Telnet or FTP) running on the web server.
- Verbose Error Messages: Displaying sensitive system information (database connection strings, file paths, stack traces) to the user during an application error.
- Unpatched Systems: Running outdated web server software (Apache, Nginx) or OS versions.
Defense: Implement a strict hardening process (covered in Lesson 51), use automated configuration management, and ensure sensitive files are correctly restricted by file permissions.