An Architecture for Misconfiguration Patching of Web Services: A Case Study of Apache Server

Services are usually left configured by default and therefore subjects to vulnerabilities because they are not security enforced. Web services are so popular that they are targets of attacks to intrusions related to vulnerabilities discovered by attackers. This work proposes an architecture for patching Web service misconfigurations related to existing vulnerabilities. The approach underlying this architecture first retrieves and structures anti-vulnerability measures published by the official service manufacturers. Second, it evaluates the risk level using Common Vulnerability Scoring System (CVSS) on the current state of configurations. The proposed approach has been applied on Apache server on four vulnerabilities: version discovery, XSS, SQL injection and deny of service. Experimental results on a vulnerable environment demonstrate that the proposed approach considerably reduces vulnerabilities compared to similar solutions