Skip to main content

Directory listing

Need​

Prevention of unauthorized access to directory listings

Context​

  • Requirement of PHP 7.0 or higher for running the application
  • Usage of Laravel framework for PHP web development
  • Usage of illuminate/support for providing support functions and utilities in the Illuminate framework
  • Usage of illuminate/filesystem for file system operations in Laravel

Description​

Non compliant code​

Route::get('/display_directories', function () {
    $path = public_path();
    $directories = File::directories($path);
    return view('directories', ['directories' => $directories]);
});

In the above code snippet, when the /display_directories route is hit, it returns a list of all directories in the public path of the Laravel application. This is done by using the File::directories method provided by Laravel's File facade. The list of directories is then passed to the directories view and displayed to the user.

This code is vulnerable because it exposes the application's directory structure to the user, potentially including sensitive information such as configuration files, source code, and data files. An attacker could use this information to understand the layout of the application's file system and target specific files for exploitation.

In addition, this code does not check if the user is authenticated or authorized to view the directory listing, meaning any user, including potential attackers, can view the list of directories.

It is generally a bad practice to expose the directory structure of your application to the public. It is recommended to disable directory listing and ensure that only authenticated and authorized users can access sensitive information.

Steps​

  • Disable directory listing in the server configuration. This is usually done in the server's main configuration file (httpd.conf for Apache, nginx.conf for Nginx).
  • Remove the route that displays the directories. This is a security risk as it exposes the structure of your application to potential attackers.
  • If you need to list directories for a legitimate reason, ensure that you only list directories that are necessary for the functionality of your application. Never list system directories or directories containing sensitive information.
  • Implement access control measures to ensure that only authorized users can view the directory listings. This could be done through authentication and authorization mechanisms.
  • Consider using a whitelist approach where only specific, approved directories can be listed, rather than a blacklist approach where certain directories are blocked.

Compliant code​

// Remove the following vulnerable code
Route::get('/display_directories', function () {
    $path = public_path();
    $directories = File::directories($path);
    return view('directories', ['directories' => $directories]);
});

The above code is vulnerable because it exposes the directory structure of the application to the users. This can be exploited by attackers to gain knowledge about the system and plan further attacks.

To fix this vulnerability, we need to disable directory listing in the server configuration. This is usually done in the server's main configuration file (httpd.conf for Apache, nginx.conf for Nginx).

Next, we need to remove the route that displays the directories. This is a security risk as it exposes the structure of your application to potential attackers.

If you need to list directories for a legitimate reason, ensure that you only list directories that are necessary for the functionality of your application. Never list system directories or directories containing sensitive information.

Implement access control measures to ensure that only authorized users can view the directory listings. This could be done through authentication and authorization mechanisms.

Consider using a whitelist approach where only specific, approved directories can be listed, rather than a blacklist approach where certain directories are blocked. This is a more secure approach as it ensures that only approved directories are accessible, reducing the risk of an attacker gaining access to sensitive information.

References​

Last updated on