-
Notifications
You must be signed in to change notification settings - Fork 52
TWA 0406
"Possible config file being served (maybe protected?) at: ${url}"
In the message output the variable ${url} is replaced by the URL of the configuration file.
Configuration files of the web server or other programs running on the server should not be published by the web server. The web server sends not the content of the configuration file but an error message "403 Forbidden". With this information a possible attacker knows that the file exists on the web server. The attacker gets the information that such a configuration is used.
It is good to prevent serving the internal data files. A better protection is to hide the existence of the internal data files.
Current (August 2020) the twa script checks the files: 'config.xml', 'config.json', 'config.yaml', 'config.yml', 'config.ini' and 'config.cfg'.
Configure the web server to not publish files with internal data. The web server should respond with "404 Not Found" or with a redirection to a standard error page.
There exists several configuration options to suppress files with name (pattern) in a blacklist or files not in whitelist. Search the web for examples.