I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are actually served up by nginx.
Theme cfg file:
All YML files in
/config such as
/composer.lock /composer.json /phpbb/composer.json /vendor/composer/installed.json
Cache files (but looks empty):
Also a .htaccess blocks
/config.php. config.php contains the database credentials but only sets variables – no output. common.php has code but doesn't seem to be a security risk.
I haven't configured nginx to block access to these and I would like to ask if there is any specific vulnerability due to these files being exposed to the public?
I know it is good practice to prevent access to anything that the public doesn't need, but what are the concrete risks here?
So far I've come up with these but I wouldn't say they're concrete risks:
The theme cfg files exposes the phpBB version, which could lead an attacker to find out what bugs are in that version.
If PHP somehow became disabled then
/config.phpcould be served up, giving the database credentials.
Anything better than these?