For Teachers · Back to the Module · Print with your browser's Print command.

A6 Worksheet: Application Framework and CMS Configuration

Student Worksheet (about 35 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: P13, P14

Learning Objectives

• [ ] Map a framework's configuration file and setting names to the five mistakes: debug on, secret exposed, wrong environment, lifecycle expired, writable code.
• [ ] Find application projects on a server from their configuration files without running them.
• [ ] Explain why on-disk checks and HTTP checks of the same weakness complement each other.

Key Terms

Write each definition in your own words.

• Debug Mode: ______________________________________________
• Environment File: ______________________________________________
• Trusted Host: ______________________________________________
• Lock File: ______________________________________________
• End of Life: ______________________________________________
• Hardening: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-APP-,WEB-CMS- --out a6 and group the findings under the five mistakes.
2. Read the vulnerable and hardened Laravel, Symfony, Rails and Spring Boot files in internal/lab/fixtures_containers_apps.go and write the one-line fix for each.
3. Pick one framework you use and list its equivalent of each of the five mistakes, with the exact setting name; propose it as a new check (module A4).

Self-Check Questions

1. Which Spring Boot setting publishes environment variables over HTTP?

• [ ] a) server.port=8080
• [ ] b) management.endpoints.web.exposure.include=*
• [ ] c) spring.profiles.active=prod
• [ ] d) management.server.port=9090

1. Why does OpenVAPT read .env files without following symbolic links?

• [ ] a) Symbolic links are slower to read
• [ ] b) A site user could replace .env with a link to a root-only file such as /etc/shadow
• [ ] c) Frameworks forbid links
• [ ] d) Symbolic links cannot point to files

1. A composer.lock is 800 days old. What does that prove?

• [ ] a) The application is vulnerable to a specific CVE
• [ ] b) No dependency updates have been applied in that time, so every library fix since then is missing
• [ ] c) Composer is not installed
• [ ] d) The lock file is corrupt

1. What does Rails config.force_ssl = true do beyond redirecting to HTTPS?

• [ ] a) Nothing else
• [ ] b) Marks cookies Secure and sends Strict-Transport-Security
• [ ] c) Disables the asset pipeline
• [ ] d) Encrypts the database

1. What does Drupal do until trusted_host_patterns is set?

• [ ] a) Trusts any Host header
• [ ] b) Refuses all requests
• [ ] c) Requires HTTPS
• [ ] d) Disables update.php

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Laravel documentation, Deployment: https://laravel.com/docs/12.x/deployment
• Symfony documentation, How to Deploy a Symfony Application: https://symfony.com/doc/current/deployment.html
• Ruby on Rails Guides, Securing Rails Applications: https://guides.rubyonrails.org/security.html
• Spring Boot documentation, Actuator endpoints: https://docs.spring.io/spring-boot/reference/actuator/endpoints.html
• Drupal.org, Trusted Host settings: https://www.drupal.org/docs/getting-started/installing-drupal/trusted-host-settings
• OWASP ASVS 4.0.3, V14 Configuration: https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x22-V14-Config.md
• OWASP WSTG-CONF-02, Test Application Platform Configuration: https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/02-Test_Application_Platform_Configuration/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.