Are exposed php class files a security vulnerability?

Question

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although indexes are turned off). Browsing to them just gives a blank page, since they don't have any output and aren't even initializing any objects, just declaring classes.

Is this a security issue, and how large of one? My gut feeling is that it's a terrible idea, but other than giving an attacker information into the server setup I don't have any particular reason to think so.

Answer 1

Fundamentally, whether something is a security risk depends on whether or not they can find and exploit a vulnerability, whether it be in the code, in the system, or in the people.

In your case, your users may be able to guess file names of class files, but cannot see their contents. Let's assume the worst case and they manage to guess the names of every file so now they have an entire index.

If the file names tell them that you're using some library that has a hole in it, then that's a risk.

If the file names themselves give information that can lead to a risk, then that's a risk too.

If the file names match some file names which have some esoteric bug in Apache or something, then that could be a risk too.

If the knowledge of the file names allows them to call up some of your staff and convince them to give them the contents of the file or modify the file, then that's a risk.

But no, knowing the names of the files isn't inherently a risk; it's only a risk if that tells them something about how the system works and clues them into a vulnerability.