Security Misconfiguration

Also Known As

TL;DR

Explanation

Security misconfiguration is consistently the most prevalent OWASP finding and encompasses: default credentials left unchanged, unnecessary features or services enabled, overly permissive cloud storage buckets, verbose error messages exposing stack traces, missing security headers, and unpatched software. In PHP, a hardened configuration disables display_errors in production, sets expose_php=Off, restricts open_basedir, disables dangerous functions, and keeps the runtime patched.

Common Misconception

Why It Matters

Common Mistakes

• Leaving APP_DEBUG=true or display_errors=On in production — stack traces reveal file paths, credentials, and logic.
• Using default credentials for databases, admin panels, or cloud consoles.
• Exposing .env, .git, or phpinfo() endpoints publicly.
• Not disabling unused PHP extensions and functions (exec, system, shell_exec) in production.

Code Examples

# Misconfigured production server:
php.ini:
  display_errors = On          # Stack traces to users
  expose_php = On              # Advertises PHP version
  allow_url_include = On       # Enables RFI

nginx:
  autoindex on;                # Directory listing enabled
  server_tokens on;            # Nginx version in headers

.env file readable via HTTP:   # DB credentials exposed
  APP_DEBUG=true               # Debug mode in production

; php.ini production hardening checklist
expose_php           = Off   ; hides X-Powered-By: PHP/8.x
display_errors       = Off   ; CRITICAL — never expose to users
log_errors           = On
disable_functions    = exec,shell_exec,system,passthru,proc_open
allow_url_fopen      = Off
allow_url_include    = Off
session.cookie_httponly = On
session.cookie_secure   = On
session.use_strict_mode = On

; nginx — hide server version, disable directory listing
server_tokens off;
autoindex off;

; File permissions:
$ find /var/www -type f -exec chmod 644 {} \;
$ find /var/www -type d -exec chmod 755 {} \;
$ chmod 600 .env

References

• ↗ https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/PHP_Configuration_Cheat_Sheet.html

Tags

Related Terms