Security Misconfiguration
Default configurations, open CORS policies, debug mode in production, or verbose error messages expose your application to attackers.
How It Works
Security misconfiguration is one of the most common vulnerabilities. It includes leaving debug mode enabled in production, using permissive CORS (Access-Control-Allow-Origin: *), exposing stack traces in error responses, keeping default credentials, or leaving unnecessary features enabled. Attackers probe for these misconfigurations automatically using scanning tools.
const app = express();
app.use(cors({ origin: '*' }));
app.use((err, req, res, next) => {
res.status(500).json({ error: err.stack });
});const app = express();
app.use(cors({ origin: 'https://myapp.com' }));
app.use((err, req, res, next) => {
console.error(err);
res.status(500).json({ error: 'Internal server error' });
});Real-World Example
In 2017, the Equifax breach that exposed 147 million records was caused partly by an unpatched Apache Struts vulnerability combined with misconfigured network security that allowed lateral movement.
How to Prevent It
- Restrict CORS to specific trusted origins
- Never expose stack traces or debug info in production
- Use environment-specific configurations
- Regularly audit your security settings
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Access Control
highUsers can act outside their intended permissions, accessing other users' data or admin functionality without proper authorization checks.
Cryptographic Failures
highSensitive data is exposed due to weak or missing encryption — using outdated algorithms like MD5/SHA1, storing passwords in plaintext, or transmitting data without TLS.
Supply Chain Failures
mediumYour application inherits vulnerabilities from third-party dependencies — outdated packages with known CVEs that attackers actively exploit.
Injection (SQL, NoSQL, Command)
criticalAttacker inserts malicious code into queries or commands by exploiting unsanitized user input — SQL injection, NoSQL injection, and OS command injection.