PHP files browsable: is this a vulnerability?

Question

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).

Do you think this is a security hole? If yes, in which sense?

Answer 1

What you're describing is normal directory listing

In itself, directory listing is not a security issue. If the security of your system is compromised after figuring out the structure of your files and directories, then you're relying on security through obscurity, which is bad. Examples of this bad practice include:

• Using secret directory names to access sensitive files.
• Limiting the execution privileged functions to only access their URLs rather than using proper permissions.
• Leaving special doors/backdoors for developers.

However, as part of a good security policy, after implementing proper security measures, it's beneficial to obscure the working parts of your system. The less you show about your system, the less information an attacker can get on you, which means you're making their job more difficult.

"So, what should I do?" you ask. Simple: Disable directory listing in your web server configurations. In Apache, you go to your httpd.conf and find the line where it says

Options Includes Indexes

Remove Indexes from the line, then restart your apache.

Answer 2

To add to the answers of @adnan and @william-calvin:

It "may" be a problem ;)

1. It does reveal names of files that are only accessible by, for example, authenticated users (Think "change_settings.php" for logged-in users). Now this in itself is not a problem. If his website is well written, then he will perform proper authorization checks before loading each file. From another point of view, a good crawler/spider will "map" all files that are accessible anyways.

2. If he is messy with backups files (think: secret.bak or blah.php.old), then other will be able to read these files. This is also the case for quick phpinfo() and db_dump.sql files.

3. He may include files, and have these with a non-php extension, such as db.inc, depending on your apache setup, an attacker may be able to read these.

So, as explained by the others - it is bad practice. It gives out more information then it should.

Answer 3

Yes.. This is definitely an issue.

If I know your structure, I will be able to get better understanding of your system which makes me easier to attack your system.

It is recommended to turn off your directory listing (See this tutorial if you are on CPanel)

The less hackers know, the harder they need to think..

Answer 4

Yes, regarding to above answers, I don't want to share same information, but real event that happened to my organization.

We had a web server (Front end of which clients can see their internet account information, ability to recharge, etc).

The developer uploaded a BigDump to backup the triple A server data, in that while, an attacker reviewed the directory listening and found dump file which contain all scratch cards and account information, hopefully, he reported to me and we solved this issue.

As also mentioned, relying on security through obscurity, its better to disable directory listening, I made a policy for my organization that this feature should be disabled in all web servers.

Answer 5

To add to Adnan's answer, some PHP frameworks, like PyroCMS, solve the problem in your question by using a combination of .htaccess files and having an index file, named something like index.php, in each and every directory.

An .htaccess file is like an extension to your server configuration in files like php.config, but can be included directly in the site folders, although in certain cases they may not be allowed or may not work because of the server files. Also, you can use them even if you don't have access to the server files, for example if you have a site in the cloud somewhere. They can be used to limit access to files in the directory they are in, or in child folders. PyroCMS and other frameworks often have an htaccess file in every single folder, many of which limit or deny access to the folder and all its subfolders.

index.php is one of the default pages to show when the URL points to the folder, although you can configure these default pages in your server files. For example, if the user navigates to example.com/folder, and there are none of these default files in this directory, the page will show what your friend likely sees, which is probably the view Adnan shows in his answer. However, if there is an index.php file in that folder, the page will instead show whatever is in <site folder>/folder/index.php. PHP frameworks often have an index.php in every or almost every folder and subfolder for you. Many of these files have something like:

<div>Forbidden!!!</div>
    <div>Please don't go here! It's very sensitive!</div>

As these .htaccess and index.php files are already put in all these folders, you don't have to do it yourself, although you can take them out if you want or need to to fit your site. Even if you don't ultimately use these frameworks, downloading a couple and seeing what they do can be helpful in designing your site. Watch out if you do this, though, as many of them are hundreds of megabytes.

By the way, yes, it is bad practice to have these files browsable. The point with this answer is that there are tools you can use to prevent you from having to repeat boilerplate code thousands of times over, sometimes literally, and it just so happens the topics in this question involve boilerplate code these tools can help with.

Answer 6

BTW, there is no httpd.conf in Ubuntu ( right now on 14.04 ; do not search for it, you'll edit apache2.conf file).

To save your PHP driven website from the script kiddies, you can read my long tutorial for hardening WordPress (I provided link for copyright protection plus probably you'll know about more unknown vulnerable points). WordPress is just an example, actually the content is applicable to any PHP-MySQL or even PHP driven website.

Secondly, unrelated to the original question; The Linux Kernel should be hardened too. You can see my gist - https://gist.github.com/AbhishekGhosh/9407137

Normally PHP will not open in the browser like a text file, but showing the path, name and probably gives the indication that the server administrator is not very experienced and makes it more vulnerable.

Do not try to control from .htaccess level, keep .htaccess as light as possible. It is actually in the public directory...