Date: Mon, 30 Oct 2017 10:09:55 -0400 From: Michael Orlitzky <michael@...itzky.com> To: oss-security@...ts.openwall.com Subject: Re: Magento: Leaking of config file local.xml On 10/30/2017 05:24 AM, Hanno Böck wrote: > Magento is a web shop written in PHP. > > Magento stores its configuration in a file local.xml, stored in the > webroot under app/etc/local.xml. As it is an xml file by default a web > server will not parse it in any way, but directly expose it to users. Thanks for publicizing this, it's an ancient issue, see e.g. https://tomrobertshaw.net/2012/11/magento-security-check-your-appetclocal-xml-file/ I think it may finally be fixed in the 2.x series of Magento which now has a "pub" directory beside "app" in the tree. With DocumentRoot = "pub", your local.xml should be safe. > Magento protects against this by shipping an .htaccess file that blocks > access to that directory. However that is not a sufficient > protection. .htaccess files are specific to the Apache web server. Indeed. And since you mentioned Drupal, they've done the same thing in the past (search "code execution"): https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2013-11-20/sa-core-2013-003-drupal-core What's worse is that the Drupal status report will warn you about the issue, but the "vulnerability check" that it does simply checks for the existence of an .htaccess! So if you're running nginx and if you have their impotent .htaccess file laying around, Drupal will tell you that everything's OK. (And of course, if you fix the issue properly, the status report will tell you that you're vulnerable...)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.