uniba-ktr / dokuwiki Goto Github PK

Hi,

I'm a security researcher. Thank you for providing this useful docker image! After I set it up, I found your docker image disclose some sensitive directories and files to the public:

/inc/ 
/bin/ 
/vendor/
/bin/.htaccess
/inc/.htaccess
/vendor/.htaccess
/data/.htaccess
/vendor/splitbrain/php-archive/phpunit.xml
/vendor/composer/installed.json
/lib/plugins/authad/lang/eu/settings.php

To make things worse, TRACE, PUT and DELETE http methods on these files are open to outside, which means they can be arbitrarily changed by outside attackers if they want.

These files should not be exposed as warned in https://www.dokuwiki.org/security.

• The bin/ directory contains executables that may be exploited by attackers if they get its contents.
• Specially, the .htaccess files can be used in web-based exploitation, as mentioned here. They use this file to hide malware, to redirect search engines to their own sites, and for many other purposes (hide backdoors, inject content, modify the php.ini values, etc).
• phpunit.xml is for unit testing. You should not leave them on a live production server. (ref)
• composer/installed.json expose config info. (ref)
• It's recommended to restrict access to TRACE methods here.

Would it be better to block these accesses in your docker image? Thanks!

Best,
-ct