I have a client who hosts multiple sites in Apache. They're storing each site's access.log and error.log in the docroot under logs/, and they're publicly accessible via the web.

To me, this seems like bad practice, but I don't have any good arguments as why it's a bad thing. From a security standpoint, is it a bad thing for logs to be publicly accessible?


Yes it is. For one, the logs may contain personal information, such as IP addresses. They may also show what exactly the users viewed and when. More importantly, error logs may even contain sensitive information if things go wrong, such as passwords or more likely session tokens. Lastly, seeing exact errors may help attackers, who are trying to break the site. Knowing why exactly what they are doing is not working is a big help.

|improve this answer|||||
  • And it gives a very nice way to transform a local file include vulnerability into a remote file include. – ThoriumBR Apr 25 '18 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.