/security-review

Security Misconfiguration Reference

Overview

Security misconfiguration is one of the most common vulnerabilities. It occurs when security settings are not defined, implemented incorrectly, or left at insecure defaults. This includes missing security headers, overly permissive CORS, debug mode in production, and exposed sensitive endpoints.

Security Headers

Missing Headers

# VULNERABLE: No security headers
@app.route('/')
def index():
    return render_template('index.html')

# SAFE: Security headers configured
@app.after_request
def add_security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
    response.headers['Permissions-Policy'] = 'geolocation=(), microphone=()'
    return response

Header Checklist

Content Security Policy

# VULNERABLE: Overly permissive CSP
"Content-Security-Policy: default-src *"
"Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval'"

# SAFE: Restrictive CSP
"Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'"

CORS Misconfiguration

Dangerous Patterns

# VULNERABLE: Allow all origins
CORS(app, origins='*')
Access-Control-Allow-Origin: *

# VULNERABLE: Reflect origin without validation
@app.after_request
def add_cors(response):
    response.headers['Access-Control-Allow-Origin'] = request.headers.get('Origin')
    response.headers['Access-Control-Allow-Credentials'] = 'true'
    return response

# VULNERABLE: Wildcard with credentials (browsers block, but shows misconfiguration)
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

# VULNERABLE: Null origin allowed
Access-Control-Allow-Origin: null

Safe CORS Configuration

# SAFE: Explicit allowlist
ALLOWED_ORIGINS = {
    'https://app.example.com',
    'https://admin.example.com'
}

@app.after_request
def add_cors(response):
    origin = request.headers.get('Origin')
    if origin in ALLOWED_ORIGINS:
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Credentials'] = 'true'
        response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
        response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
    return response

Debug Mode in Production

Dangerous Patterns

# VULNERABLE: Debug mode enabled
# Flask
app.run(debug=True)
DEBUG = True

# Django
DEBUG = True  # in settings.py

# Express
app.set('env', 'development')

# Spring Boot
spring.devtools.restart.enabled=true
management.endpoints.web.exposure.include=*

Detection

# Check for debug indicators
if app.debug:
    # Exposes stack traces, allows code execution in some frameworks
    pass

# Check environment variables
if os.environ.get('DEBUG') == 'true':
    pass
if os.environ.get('FLASK_ENV') == 'development':
    pass

Default Credentials

Patterns to Flag

# VULNERABLE: Default/weak credentials
username = 'admin'
password = 'admin'
password = 'password'
password = '123456'
password = 'changeme'
password = 'default'

# VULNERABLE: Well-known default credentials
# Database defaults
DB_PASSWORD = 'root'
DB_PASSWORD = 'postgres'
DB_PASSWORD = 'mysql'

# Admin panel defaults
ADMIN_PASSWORD = 'admin123'
SECRET_KEY = 'development-secret-key'

Configuration Files to Check

# Docker Compose
services:
  db:
    environment:
      MYSQL_ROOT_PASSWORD: root  # VULNERABLE
      POSTGRES_PASSWORD: postgres  # VULNERABLE

# Kubernetes Secrets (base64 encoded defaults)
apiVersion: v1
kind: Secret
data:
  password: YWRtaW4=  # 'admin' base64 encoded - VULNERABLE

Exposed Endpoints

Admin/Debug Endpoints

# VULNERABLE: Exposed debug endpoints
@app.route('/debug')
@app.route('/admin')  # without authentication
@app.route('/metrics')  # without authentication
@app.route('/health')  # may expose sensitive info
@app.route('/env')
@app.route('/config')
@app.route('/phpinfo.php')
@app.route('/.git')
@app.route('/.env')

# Spring Boot Actuator endpoints
/actuator/env
/actuator/heapdump
/actuator/configprops
/actuator/mappings

Protection

# SAFE: Protect sensitive endpoints
@app.route('/admin')
@require_admin
def admin_panel():
    pass

@app.route('/metrics')
@require_internal_network
def metrics():
    pass

# Spring Boot: Restrict actuator
management.endpoints.web.exposure.include=health,info
management.endpoint.health.show-details=never

TLS/SSL Misconfiguration

Insecure Patterns

# VULNERABLE: SSL verification disabled
requests.get(url, verify=False)
urllib3.disable_warnings()

# VULNERABLE: Weak TLS versions
ssl_context.minimum_version = ssl.TLSVersion.TLSv1  # Use TLS 1.2+

# VULNERABLE: Weak cipher suites
ssl_context.set_ciphers('ALL')
ssl_context.set_ciphers('DEFAULT')

Secure Configuration

# SAFE: Proper TLS configuration
import ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.minimum_version = ssl.TLSVersion.TLSv1_2
context.set_ciphers('ECDHE+AESGCM:DHE+AESGCM:ECDHE+CHACHA20')
context.verify_mode = ssl.CERT_REQUIRED
context.check_hostname = True

Directory Listing

Dangerous Patterns

# VULNERABLE: Directory listing enabled
# Nginx
autoindex on;

# Apache
Options +Indexes

# Python
python -m http.server  # Lists directories by default

Secure Configuration

# SAFE: Directory listing disabled
# Nginx
autoindex off;

# Apache
Options -Indexes

Verbose Error Messages

Dangerous Patterns

# VULNERABLE: Detailed errors in response
@app.errorhandler(Exception)
def handle_error(e):
    return jsonify({
        'error': str(e),
        'traceback': traceback.format_exc(),
        'query': last_executed_query,
        'config': app.config
    }), 500

# VULNERABLE: Stack traces exposed
app.config['PROPAGATE_EXCEPTIONS'] = True

Secure Error Handling

# SAFE: Generic error messages
@app.errorhandler(Exception)
def handle_error(e):
    app.logger.error(f"Error: {e}", exc_info=True)  # Log details server-side
    return jsonify({'error': 'An unexpected error occurred'}), 500

Cookie Security

Insecure Patterns

# VULNERABLE: Insecure cookie settings
response.set_cookie('session', value)  # Missing flags

# VULNERABLE: Explicit insecure flags
response.set_cookie('session', value, secure=False, httponly=False, samesite='None')

Secure Cookie Configuration

# SAFE: Secure cookie settings
response.set_cookie(
    'session',
    value,
    secure=True,       # HTTPS only
    httponly=True,     # No JavaScript access
    samesite='Lax',    # CSRF protection
    max_age=3600,      # Reasonable expiration
    path='/',
    domain='.example.com'
)

# Flask session configuration
app.config['SESSION_COOKIE_SECURE'] = True
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'

Permissive File Permissions

Dangerous Patterns

# VULNERABLE: World-readable sensitive files
os.chmod(config_file, 0o777)
os.chmod(private_key, 0o644)

# VULNERABLE: Overly permissive umask
os.umask(0o000)

Secure Permissions

# SAFE: Restrictive permissions
os.chmod(config_file, 0o600)  # Owner read/write only
os.chmod(private_key, 0o400)  # Owner read only
os.chmod(script, 0o700)       # Owner execute only

HTTP Methods

Dangerous Patterns

# VULNERABLE: All methods allowed
@app.route('/api/data', methods=['GET', 'POST', 'PUT', 'DELETE', 'TRACE', 'OPTIONS'])

# VULNERABLE: TRACE method enabled (XST attacks)
# VULNERABLE: Unnecessary methods on sensitive endpoints

Secure Configuration

# SAFE: Explicit method restrictions
@app.route('/api/data', methods=['GET'])
def get_data():
    pass

@app.route('/api/data', methods=['POST'])
@require_auth
def create_data():
    pass

Grep Patterns for Detection

# Debug mode
grep -rn "debug.*=.*[Tt]rue\|DEBUG.*=.*[Tt]rue" --include="*.py" --include="*.js" --include="*.json"

# CORS wildcards
grep -rn "Access-Control-Allow-Origin.*\*\|origins.*\*\|origin.*\*" --include="*.py" --include="*.js"

# SSL verification disabled
grep -rn "verify.*=.*[Ff]alse\|rejectUnauthorized.*false\|NODE_TLS_REJECT_UNAUTHORIZED" --include="*.py" --include="*.js"

# Default credentials
grep -rn "password.*=.*['\"]admin\|password.*=.*['\"]root\|password.*=.*['\"]123456" --include="*.py" --include="*.yaml" --include="*.yml"

# Missing security headers (check for absence)
grep -rn "after_request\|middleware" --include="*.py" | grep -v "X-Content-Type-Options\|X-Frame-Options"

# Exposed endpoints
grep -rn "@app.route.*debug\|@app.route.*admin\|@app.route.*config\|/actuator" --include="*.py" --include="*.java"

References

• OWASP Security Misconfiguration
• OWASP HTTP Security Headers
• OWASP TLS Cheat Sheet
• CWE-16: Configuration