API8:2023 — Security Misconfiguration

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real incidents and scenarios mapped to the configuration controls that would have prevented them.

BREACH — Tesla (2018) · Cryptomining · Admin Endpoint Exposure

Kubernetes dashboard exposed to internet with no auth; AWS credentials visible; cryptominer deployed

Default Kubernetes dashboard deployment — no auth configured. Exposed on public internet. Environment variables with AWS credentials visible in the UI.

Stopped by: MIT 06 (admin endpoint: don’t expose Kubernetes dashboard to internet; require auth before access) + MIT 06 (IP restriction: management port not routable externally) — this single control would have prevented the entire breach. MIT 07 (automated scanning: check for unauthenticated admin endpoints in staging before production deployment)

INCIDENT — Firebase Open Rules (2018) · 100M Records · Default Misconfiguration

2,446 apps with Firebase databases open to read/write by anyone; default rules never changed

Firebase’s default security rules were open. Developers used the default for prototyping and shipped without changing them. No automated check verified rules before app release.

Stopped by: MIT 07 (automated scanning: validate Firebase security rules are not open before deployment) + MIT 06 (equivalent: require explicit auth configuration before any data is accessible) — and Firebase fixing the default (they did in 2019)

OWASP — CORS Misconfiguration · Account Data Theft · Reflected Origin

API reflected any Origin with credentials; attacker’s site could read authenticated user data cross-origin

CORS configured to reflect incoming Origin header. Access-Control-Allow-Credentials: true. Any website could make authenticated API calls as any logged-in user.

Stopped by: MIT 01 (CORS allowlist: explicitly enumerate permitted origins; never reflect the incoming Origin) + MIT 07 (automated check: verify CORS response headers match the allowlist, not arbitrary origins)

OWASP — Verbose Errors · SQL Injection Confirmed · Debug Mode On

Production debug mode exposed stack traces with SQL queries and table names; attacker confirmed injection point instantly

DEBUG=True in production. Framework returned full exception details including SQL. Attacker triggered an error to read the query structure.

Stopped by: MIT 02 (error handling: global handler returns generic messages, logs details internally) + MIT 07 (deployment check: verify DEBUG=false before production deploy; scan for stack traces in error responses)

← Back Ready to test yourself? →