Security Misconfiguration: Insecure by Default

Security Misconfiguration is the category that catches everyone eventually, because it does not require a mistake in your code at all — only a default left unchanged, a permission left too broad, a feature left switched on. In 2021 it rose to fifth and absorbed the old "XML External Entities" category, reflecting how much modern risk lives not in what teams write but in how they configure what they run.

Modern applications are assembled from many configurable parts — web servers, application frameworks, databases, cloud services, container platforms, identity providers. Each ships with defaults chosen for ease of setup, not security, and each exposes dozens of settings. Misconfiguration is the aggregate risk of all those knobs being turned the wrong way, or never turned at all.

Where it hides

• Default credentials. Admin consoles, databases, and devices left with the vendor's shipped username and password.
• Unnecessary features enabled. Sample apps, debug endpoints, admin interfaces, or unused ports exposed to the network.
• Verbose error messages. Stack traces and internal paths returned to users, handing attackers a map of the system.
• Missing hardening. Absent security headers, permissive CORS, directory listing enabled, cloud storage buckets left public.
• Out-of-date configuration. Settings that were reasonable at launch but were never revisited as the platform evolved.

The XXE flaw that joined this category is a textbook example. XML parsers historically arrived with external entity processing enabled by default — a feature almost no application needs, but one that lets an attacker read local files or trigger server-side requests through a crafted document. The vulnerability was never really about XML; it was about a dangerous default nobody disabled.

Configuring for security

• Harden from a baseline. Build on a documented secure configuration and apply it consistently across development, staging, and production.
• Remove what you do not use. Uninstall sample apps, disable unused features and ports, and strip debug endpoints before release.
• Change every default credential and disable default accounts as part of provisioning.
• Automate configuration with infrastructure-as-code so environments are identical, reviewable, and reproducible — no hand-tuned snowflakes.
• Disable dangerous parser features such as XML external entities unless a specific need justifies them.
• Scan continuously. Configuration drifts; automated checks catch the setting that was quietly changed last week.

Security misconfiguration is uniquely preventable and uniquely persistent, because the same convenience that makes software easy to stand up makes it easy to stand up insecurely. The defence is not heroics but hygiene — and hygiene depends on an accurate inventory of everything you run, because you cannot harden a service you did not know was there.