24

Maybe a noob question. I've tried searching but maybe my search terms were too specific.

I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply browsing to directory where it was stored; www.example.com/dir/.htaccess

What causes this and how can it be remediated?

1
  • 7
    People might be more worried about accessing .htpasswd though
    – PlasmaHH
    Commented Sep 16, 2015 at 14:07

2 Answers 2

32

It depends on the type of the webserver in question. If it's Apache 2.2, it should contain something like this in the config file (usually in the "main" apache.conf):

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy all
</Files>

If it's missing, that can cause the problem you described.

The other typical cause of this is that the client have used Apache in the past, but switched to something else (e.g. Nginx) which does not use .htaccess and hence doesn't treat it in a special way. The solution in this case is webserver-specific, but it usually boils down to restricting access to files beginning with ".ht", or - if they are really not used - you can simply delete them.

4
  • 2
    The server was nginx! Didnt realize nginx dosnt support .htaccess. Thanks!
    – Rob
    Commented Sep 16, 2015 at 10:52
  • 10
    I'd block all files starting with .. This includes .svn, .git, etc. While these shouldn't be in a directory accessible via http, I've seen several servers where they are. Commented Sep 16, 2015 at 15:31
  • @CodesInChaos: You mean you don't deploy a web directory with svn checkout?
    – Joshua
    Commented Sep 17, 2015 at 5:00
  • @Joshua your web directory should be a subfolder in version control, really. keep anything sensitive out of the webroot. Oh, and use git :p
    – Amelia
    Commented Sep 17, 2015 at 8:58
1

To give an update on @eax's response, the rules protecting files beginning with .ht have slightly changed with Apache 2.4 to below:

# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>

We can see it's a flat out "Require all denied".

You can also rename the file from .htaccess to something else as visible below:

# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

If you do so, don't forget to add the corresponding FilesMatch rule to block them from being downloaded by web clients.

This configuration is usually stored in /etc/apache2/apache2.conf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .