API-8: Security Misconfiguration

What is Security Misconfiguration?

Security Misconfiguration occurs when an API or its supporting infrastructure is configured insecurely, leaving unnecessary features, services, permissions, or information exposed. These misconfigurations can provide attackers with valuable information or unintended access, increasing the likelihood of a successful compromise.

Unlike vulnerabilities caused by coding errors, Security Misconfiguration results from improper deployment, insecure default settings, missing security controls, or poor configuration management.

Common Example

1. Verbose Error Messages
2. Debug Mode Enabled
3. Directory Listing Enabled
4. Default Credentials
5. Missing Security Headers
6. Insecure CORS Configuration
7. Public Cloud Storage

Attack Scenarion

As this is the vulnerable application, I will find lots of security misconfiguration, such as debug enable, header misconfiguration, CORS, server version disclosure, system info default page etc.

Mitigation

• Use secure default configurations and remove unnecessary features and services.
• Disable debug mode and ensure production systems do not expose stack traces or detailed error messages.
• Implement generic error handling to prevent disclosure of sensitive information.
• Apply security headers such as CSP, HSTS, X-Frame-Options, and X-Content-Type-Options.
• Configure CORS securely by allowing only trusted origins and avoiding wildcard configurations with credentials.
• Harden cloud infrastructure by preventing public access to sensitive storage resources.