2

I'm wondering whether my architecture poses a security risk. Details:

  • The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions.

  • I have a folder "user_files" that may hold any kind of user files. For example, a ksh unix file.

  • My php.ini disables the exec php function (as well as some other sensitive functions)

My question is simple yet bears 2 aspects:

  1. could somebody execute the uploaded script?
  2. what is the magnitude of the risk? If the script is executed by apache I guess the maximum it could do is to delete all apache owned files of the server, right?

Edit: this I think relates to programming, since I am also asking the question from a programming point of view (execution of scripts through php)

Improve this question
0

1 Answer 1

Reset to default
1

There are quite a few considerations that need to be made here. First, although your php.ini disables the exec php function there remains the web server security itself. Consider the following:

1) Does your web server allow script execution for other languages (perl, python, or CGI in general)? Or, perhaps scriptalias definitions.

2) Are you concerned about protecting users that view the website? i.e. if someone installs a malicious iframe or .htaccess file?

3) Are you concerned about hosting malicious/illegal content?

4) Are you concerned about being a spam/attack relay?

If someone is able to execute code under the context of the apache user, you have to assume a few things. First, you have to treat the apache user as any account with an interactive shell. Anything another user can do on the local system, the apache user would (likely) be able to. (i.e. DoS, attack other systems, attack higher privileged accounts, host content).

HTH.

Improve this answer

You must log in to answer this question.