Application Framework and CMS Configuration

Five Mistakes, Many Spellings

Frameworks differ in syntax and agree on failure modes. Debug mode is APP_DEBUG=true in Laravel (WEB-APP-001), APP_ENV=dev in Symfony (WEB-APP-003) and DEBUG = True in Django (WEB-PY-001). It is debug=True in a Flask entry file (WEB-APP-007), MAGE_MODE developer in Magento (WEB-CMS-015) and WP_DEBUG in WordPress (WEB-CMS-006). In every case the error page prints configuration, queries or source to whoever triggers an error.

Secrets live in .env files, Rails master.key and secrets.yml, Django settings.py and Spring application.properties. The questions are the same. Is the file readable by every local account (WEB-APP-002, WEB-APP-004)? Is it inside a web root (WEB-DOC-001, WEB-APP-004)? Is a generated or empty key still in place (WEB-APP-001, WEB-PY-003)? Spring Boot adds its own leak: management.endpoints.web.exposure.include=* publishes env, configprops and heapdump over HTTP (WEB-APP-006).

Environment and Transport

Production settings are a mode, not a default. Rails only marks cookies Secure and redirects to HTTPS when config.force_ssl is true (WEB-APP-005). Ghost builds every admin and member link from its configured url, so http:// there means credentials in the clear (WEB-CMS-016). Drupal trusts any Host header until trusted_host_patterns is set (WEB-CMS-013). Its update_free_access setting lets anyone run update.php (WEB-CMS-019).

Lifecycle and Writable Code

A CMS past end of life gets no security advisories: Drupal 7, 8 and 9 (WEB-CMS-012) and Joomla 3 and 4 (WEB-CMS-014) are read from version files on disk. The same reasoning applies to dependencies: a composer.lock or package-lock.json untouched for a year means every library fix since then is missing (WEB-APP-008, informational).

Code the web server can be made to run must not be writable by other users. chmod -R 777 storage makes Laravel's bootstrap/cache and Symfony's var/cache, which hold compiled PHP, writable by every account (WEB-APP-010). A .git folder inside the document root (WEB-APP-009) is one server rule away from publishing the source; WEB-EXP-001 tests whether that has already happened. WordPress adds two small exposures: wp-cron.php reachable by visitors (WEB-CMS-017) and the /?author=1 redirect that reveals login names (WEB-CMS-018).

Finding Projects Without Running Them

OpenVAPT looks for projects where administrators put them: /srv, /opt, /var/www, home folders and every configured web root, three folders deep. It recognises a framework by a marker setting (APP_KEY for Laravel, APP_SECRET for Symfony, config/master.key for Rails). Files under those folders are read without following symbolic links, because a site user could point .env at /etc/shadow. Only the path and the setting name reach the report; a value is never copied, and the report is redacted again before it is written.

In Summary

Frameworks fail the same five ways under different names: debug on, a default or readable secret, development environment in production, transport not forced and writable code or stale dependencies. Find projects from files, read .env without following links, and check each setting in its own spelling.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only WEB-APP-,WEB-CMS- --out a6 and group the findings under the five mistakes.
2. Read the vulnerable and hardened Laravel, Symfony, Rails and Spring Boot files in internal/lab/fixtures_containers_apps.go and write the one-line fix for each.
3. Pick one framework you use and list its equivalent of each of the five mistakes, with the exact setting name; propose it as a new check (module A4).

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• Laravel documentation, Deployment
• Symfony documentation, How to Deploy a Symfony Application
• Ruby on Rails Guides, Securing Rails Applications
• Spring Boot documentation, Actuator endpoints
• Drupal.org, Trusted Host settings
• OWASP ASVS 4.0.3, V14 Configuration
• OWASP WSTG-CONF-02, Test Application Platform Configuration

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). A6: Application Framework and CMS Configuration (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a6.html

@misc{openvapt_a6,
  author       = {{OpenVAPT}},
  title        = {{A6: Application Framework and CMS Configuration}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/a6.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}