2

I have a client who hosts multiple sites in Apache. They're storing each site's access.log and error.log in the docroot under logs/, and they're publicly accessible via the web.

To me, this seems like bad practice, but I don't have any good arguments as why it's a bad thing. From a security standpoint, is it a bad thing for logs to be publicly accessible?

Improve this question

1 Answer 1

Reset to default
1

Yes it is. For one, the logs may contain personal information, such as IP addresses. They may also show what exactly the users viewed and when. More importantly, error logs may even contain sensitive information if things go wrong, such as passwords or more likely session tokens. Lastly, seeing exact errors may help attackers, who are trying to break the site. Knowing why exactly what they are doing is not working is a big help.

Improve this answer
1
  • And it gives a very nice way to transform a local file include vulnerability into a remote file include.
    – ThoriumBR
    Commented Apr 25, 2018 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .