Web Application Server Security

The web server is the central part of any web-based application or marketing site. The Apache Web Server is normally placed at the edge of the network hence it becomes one of the most vulnerable services to attack. Using the default configuration may supply sensitive information which can help a hacker to attack your web server.

A badly configured Apache web server or one that is not hardened properly will expose your to significant risk. It’s critical to harden your web server configuration but the Apache configuration system is notoriously arcane and difficult to get right.

Why it’s needed

Server Misconfiguration attacks exploit configuration weaknesses found in web servers and application servers. Many servers come with unnecessary default and sample files, including applications, configuration files, scripts, and web pages.

They may also have unnecessary services enabled, such as content management and remote administration functionality. Debugging functions may be enabled or administrative functions may be accessible to anonymous users. These features may provide a means for a hacker to bypass authentication methods and gain access to sensitive information, perhaps with elevated privileges.

Servers may include well-known default accounts and passwords. Failure to fully lock down or harden the server may leave improperly set file and directory permissions. Misconfigured SSL certificates and encryption settings, the use of default certificates, and improper authentication implementation with external systems may compromise the confidentiality of information.

Apache Example:

The following default or incorrect configuration in the httpd.conf file on an Apache server does not restrict access to the server-status page:

SetHandler server-status

This configuration allows the server status page to be viewed. This page contains detailed information about the current use of the web server, including information about the current hosts and requests being processed. If exploited, an attacker could view the sensitive system information in the file.