[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <d9773cc8-16e8-e0f8-445b-023be2c835b4@orlitzky.com>
Date: Mon, 30 Oct 2017 10:09:55 -0400
From: Michael Orlitzky <michael@...itzky.com>
To: oss-security@...ts.openwall.com
Subject: Re: Magento: Leaking of config file local.xml
On 10/30/2017 05:24 AM, Hanno Böck wrote:
> Magento is a web shop written in PHP.
>
> Magento stores its configuration in a file local.xml, stored in the
> webroot under app/etc/local.xml. As it is an xml file by default a web
> server will not parse it in any way, but directly expose it to users.
Thanks for publicizing this, it's an ancient issue, see e.g.
https://tomrobertshaw.net/2012/11/magento-security-check-your-appetclocal-xml-file/
I think it may finally be fixed in the 2.x series of Magento which now
has a "pub" directory beside "app" in the tree. With DocumentRoot =
"pub", your local.xml should be safe.
> Magento protects against this by shipping an .htaccess file that blocks
> access to that directory. However that is not a sufficient
> protection. .htaccess files are specific to the Apache web server.
Indeed. And since you mentioned Drupal, they've done the same thing in
the past (search "code execution"):
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2013-11-20/sa-core-2013-003-drupal-core
What's worse is that the Drupal status report will warn you about the
issue, but the "vulnerability check" that it does simply checks for the
existence of an .htaccess! So if you're running nginx and if you have
their impotent .htaccess file laying around, Drupal will tell you that
everything's OK.
(And of course, if you fix the issue properly, the status report will
tell you that you're vulnerable...)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
