API8:2023 Security Misconfiguration

A catch-all for insecure settings: CORS that reflects the origin with credentials, debug mode in production, committed default secrets, cookies without Secure/HttpOnly/SameSite, weak crypto (MD5, SHA-1, ECB), permissive S3 bucket policies, IAM Action: "*".

What Vulkro detects

Several detectors roll up into this category: web_config (CORS, cookies), config_extras (S3, IAM, JWT alg), crypto_weakness (weak primitives) and secrets (committed credentials).

Non-compliant code

// Express: wildcard CORS with credentials, debug on, literal secret
app.use(cors({ origin: '*', credentials: true }));
app.set('debug', true);
const SECRET = 'sk_live_4eC39HqLyjWDarjtT1zdp7dc';

Compliant code

// Express: origin allowlist, debug off, secret from the environment
app.use(cors({ origin: ['https://app.example.com'], credentials: true }));
app.set('debug', false);
const SECRET = process.env.STRIPE_SECRET_KEY;

What Vulkro detects​

Non-compliant code​

Compliant code​

References​

What Vulkro detects

Non-compliant code

Compliant code

References