1

What is the security problem to use Options FollowSymLinks in the Apache configuration?

We use the following configuration:

AllowOverride None
Options None FollowSymLinks
3

If you enable following of symbolic links, and an attacker gains access to something allowing him to create arbitrary files on your webserver, he could then create symbolic links to any file on your system (e.g. /etc/passwd, configurations files of databases, ...)

  • Therefore the severity of the problem can not be high: "an attacker gains access to something allowing him to create arbitrary files on your webserver" – Michael May 22 '17 at 11:07
  • Depends what you define as 'high'. Having access to the password file could lead the attacker to gain access to the machine, having the database password can allow him to delete all your records. It does not qualifies as 'low risk' to me. – M'vy May 22 '17 at 11:27
  • I agree with you. I mean the initial access is not simple. – Michael May 22 '17 at 11:36
  • Its relatively easy to make a mistake that allow it. – M'vy May 22 '17 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.