A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS)

I see that it's possible to reach the virtual hosts from another domain (or just the ip), but how's that affecting security? No source code would be displayed since all scripts would still be executed.

Are there any examples of common coding patterns that would be dangerous to execute? Session variables? (logging in to site A, being thought of as logged in on site B when accessed through site A)

Anything else I'm missing?


As a general rule, things should not be made accessible in ways that were not intended or for reasons that were not intended. The best reason to follow this pattern is because you don't know how it might be abused. Just because you can't think of a vulnerability doesn't mean somebody else can't.

But in this case, I have seen this pattern used against a site owner.

As an example, virtual-hosting operations typically run website content under user isolated users. That is, foo.com runs as the user foo, while bar.com runs as the user bar, and neither can access the other's files.

But a secondary route for accessing site content, such as might run foo.com content using some alternate context -- perhaps www-data, for example. And in that case, foo.com/filemanager.php could be accessed as, which gives the visitor access through the site using a different set of permissions than the site owner thought.

There are other potential vulnerabilities as well that I can thing of -- things having to do with configuration differences, path differences, access-control, and other such details. All of this is somewhat installation-dependent, but the potential is there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.