phpBB under nginx, htaccess protection is lost – what are the risks?

Question

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are actually served up by nginx.

Theme cfg file:

/styles/prosilver/style.cfg

All YML files in /config such as /config/auth.yml

Composer files:

/composer.lock
/composer.json
/phpbb/composer.json
/vendor/composer/installed.json

Cache files (but looks empty):

/data_cron.lock_check.php.lock

Also a .htaccess blocks /common.php and /config.php. config.php contains the database credentials but only sets variables – no output. common.php has code but doesn't seem to be a security risk.

I haven't configured nginx to block access to these and I would like to ask if there is any specific vulnerability due to these files being exposed to the public?

I know it is good practice to prevent access to anything that the public doesn't need, but what are the concrete risks here?

So far I've come up with these but I wouldn't say they're concrete risks:

• The theme cfg files exposes the phpBB version, which could lead an attacker to find out what bugs are in that version.

• If PHP somehow became disabled then /config.php could be served up, giving the database credentials.

Anything better than these?

Answer 1

There is also a config file for NGINX which should protect these files:

https://github.com/phpbb/phpbb/blob/3.1.x/phpBB/docs/nginx.sample.conf

# Deny access to internal phpbb files.
        location ~ /(config\.php|common\.php|includes|cache|files|store|images/avatars/upload) {
            deny all;
            # deny was ignored before 0.8.40 for connections over IPv6.
            # Use internal directive to prohibit access on older versions.
            internal;
        }

If people can access / retrieve the contents of the files, they may get your database credentials and other critical data.