Sample Endpoints with Default Admin Credentials

Welcome to the very first lesson of the "Security Misconfiguration" course! In this lesson, we'll explore the concept of default credentials and their impact on web application security. Default credentials are pre-set usernames and passwords that come with many applications and devices. While convenient for initial setup, they pose significant security risks if not changed.

By the end of this lesson, you'll learn how to identify, exploit, and secure endpoints that use default credentials. Let's dive in! 🚀

Default credentials are the factory-set usernames and passwords that come with many applications and devices. They are intended for initial setup but can become a security risk if not changed. For example, an admin panel might come with a default username admin and password admin123. If these credentials remain unchanged, anyone with access to the application can log in and potentially access sensitive data.

Default credentials exist primarily to help developers quickly test and set up applications during development. However, they often find their way into production environments due to rushed deployments, poor documentation, or simple oversight. Sometimes, teams intentionally keep them unchanged for "easier maintenance," which creates significant security risks. It's crucial to change default credentials to prevent unauthorized access and protect your application from potential breaches.

Let's look at a code snippet that demonstrates the use of default credentials in an admin panel. This example shows how an attacker might exploit these credentials to gain unauthorized access.

// Default admin credentials (NEVER do this in production)
const DEFAULT_ADMIN = { username: "admin", password: "admin123" };

router.post('/admin/login', (req, res) => {
  const { username, password } = req.body;

  // If default credentials are still active, an attacker can log in
  if (username === DEFAULT_ADMIN.username && password === DEFAULT_ADMIN.password) {
    return res.json({ message: "Login successful", access: "FULL_ADMIN" });
  }

  return res.status(401).json({ error: "Unauthorized" });
});

In this code, the admin panel uses default credentials (admin and admin123). If these credentials are not changed, anyone can log in as an admin, posing a significant security risk. This vulnerability can be exploited to access sensitive data or perform unauthorized actions.

Let's look at another vulnerable endpoint that demonstrates how an attacker can exploit default credentials to access sensitive user data:

router.get('/admin/users', (req, res) => {
  const { access } = req.headers;

  // If attacker logs in using default credentials, they can dump user data
  if (access === "FULL_ADMIN") {
    return res.json([{ id: 1, name: "Alice" }, { id: 2, name: "Bob" }]);
  }

  return res.status(403).json({ error: "Forbidden" });
});

This endpoint is particularly vulnerable because it relies on a simple header check for authentication. An attacker who has logged in with default credentials can easily access all user data by including the FULL_ADMIN access header in their request.