Security Misconfiguration
Insecure defaults, unnecessary features, or misapplied permissions left in production.
What it is
Security Misconfiguration moves up from A05:2021 to A02 in 2025, reflecting that configuration drift is now the #2 most common cause of exposure across applications tested. The category covers any deployment state where a system is exposed because of how it is configured, not how it is coded. Examples include cloud storage buckets with public-read access, debug endpoints reachable in production, default credentials never changed, XML parsers with external entities enabled, unnecessary features running on production hosts, and missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options). XML External Entity (XXE) is consolidated into this category in 2025.
Common patterns
- •S3, GCS, or Azure Blob storage with public-read or list-bucket permissions on private data.
- •XML parsers (lxml, DocumentBuilderFactory, XmlReader) instantiated without disabling external entities (XXE).
- •Verbose error pages or debug endpoints (DEBUG=True in Flask/Django, app.debug=true in Express) live in production.
- •Default credentials on databases, admin panels, or management interfaces.
- •Security headers missing or misconfigured: no HSTS, weak CSP, missing X-Frame-Options.
- •Cloud IAM policies with wildcard resources (Resource: *) on actions that should be scoped.
What Deva detects
Deva includes IaC scanning rules for Dockerfile, Kubernetes manifests, Terraform, and CloudFormation. The rule pack flags S3 buckets with PublicRead ACLs, IAM policies with Resource:'*', containers running as root, Kubernetes services without network policies, and missing security headers in framework configs. XML parser instantiations without secure-defaults arguments are reported per language. Debug-flag detectors flag production configs that leave verbose error handling enabled.
CWE detection guides
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2017 | Verizon (14M records via S3) | A vendor-managed S3 bucket containing customer service call data was set to public read. The exposure was discovered during a routine third-party audit. The same pattern has been the root cause of dozens of large disclosures since 2017. |
| 2020 | Microsoft Power Apps (38M records) | Default OData API permissions on Microsoft Power Apps portals made customer data publicly queryable. The defaults were technically documented but not surfaced clearly to administrators, illustrating how misconfiguration risk shifts when the secure-by-default expectation is unmet. |
Compliance framework impact
- •NIST 800-53 CM-6 Configuration Settings, CM-7 Least Functionality
- •PCI-DSS v4.0 Req 2.2 Secure configurations
- •CMMC 2.0 CM.L2-3.4.1 Baseline configuration, CM.L2-3.4.6 Least functionality
- •FedRAMP CM-6, CM-7
Deva detects the security misconfiguration patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.