Welcome to the third and last part of security Miss configuration session.
In this part. We will discuss security misconfigurations mitigation.
We will start discussing what makes
an application vulnerable. And then, we will hunt all gasp Juice
Shop, vulnerable source code. Before closing, this session. We
will discuss how to avoid such vulnerabilities. Only
required Services, Sports Pages accounts
in privileges should be installed in a
bold. Otherwise, the attack surface will be wider and
more difficult to protect typically.
Default accounts in their passwords are public knowledge since they are
documented deploying the application. With such accounts enabled,
leave the door wide open, two attackers, overly
informative error messages, provide attackers better
understanding of the target application.
Security settings of some system, components, such as application Frameworks
or databases are not set to secure values.
Latest security features are
missing disabled or not configured securely, all
these leaves the application vulnerable. If the
server does not send appropriate Security address or directives or
they are not set to secure values, then both the
client and client-server. Communication are at risk. Let's
have a look at the source code from projects page. We
will jump straight.
To the GitHub repo.
Let's first check the security, Miss configuration in the
beginning point.
Post request to the login and point are handled by
the login function.
This function is provided by the login dot J's file in
the root folder.
This is where everything happens.
First, does equalized query, which returns a promise.
If the query succeeds returning zero or more records,
then execution continues here.
When the sequel is query files with an error, then
it is cut here. And the error past two decks,
press framework.
We need to see how the framework is handling a horse. Let's
get back to the server.js file.
Okay, this is the error handling setup.
Are horses are handled by the error Handler. Middleware?
And you ever enter middleware is provided by the npm
error Handler package. Let's check its documentation.
Ridding the first line should give us a good idea of what is
going on. This is a development only middleware.
Then it continues full-length or stack traces in
the internal details of any object passed to this. Middleware will
be sent back to the client. Of course. This
is not the right error. Handler middleware to have in a production environment.
Let's get back to the repo and check the Miss configuration. We
found in the complaint feature.
Complaints file uploads are handled here.
The root is best several middleware functions, but
XML uploads are handled by the handle, XML
upload function.
This is interesting. It looks like that to disable the feature. Someone
came to the implementation and force returning, the 410 status
code error with the custom message leaving
the original implementation and touched.
Let's discuss mitigation.
An automated and repeatable hardening process will allow to create similar
environments. Note that accounts should be different
or at least use different credentials. Deploy.
Only what is really required without any unnecessary
features components, documentation and samples security,
configurations of every component, should be reviewed and
update as part of the patch management process in
particular cloud storage permissions, or if an
AWS S3 buckets, lead to sub domain take over.
Segmented. Application, architectures, provide effective, secure,
separation between components or tenants containerization
and Cloud security groups, make the task easier.
Enforce client site security. Configuring security others
with secure values to be sent as part of responses.
Security settings and configurations should be continuously verified
and tested in all environments.
In our next session, we will discuss xss or
cross-site scripting and you'll then take your time to
carefully. Read the security, Miss configuration section of a
wasp top 10.