Are Symlinks on templates a security problem, and if yes, why?

Question

Magento recommends to not use templates via symlinks:

Advanced > Developer > Template Settings > Allow Symlinks

Warning! Enabling this feature is not recommended on production environments because it represents a potential security risk.

Until today I can't see any risks here.

• What is the risk?

Answer 1

Symlinks aren't necessarily bad.

First of all: If trying to open a symlink target, the file permissions of the target are in effect. If you're not allowed to read/write/execute the symlink target, nothing happens.

But: You might be able to run files outside your document root (sometimes that's actually what you want to do with them, right?). The problem can occur if your're not in a suEXEC environment and have an apache or www-data user on a shared hosting which, is in charge of serving files from different accounts. Your system user is not allowed to access files of another customer, but the apache/www-data user will mostly have read rights on all the shared accounts. This might be a scenario where one user can access files of another user on a shared host. Not with your own user, but by accessing the file via browser with the apache/www-data user. To sum up: In this scenario you will be able to access other users' files => bad.

The next bad thing is that an attacker could create symlinks, also to files like /etc/passwd,..., download this data and proceed with this information. This is not just only up to the symlink, but also up to a bad server configuration (where access to these files is strictly limited). So not using symlinks prevents from some more possible attacks.

It's not just about the symlink itself being a security risk, but a server configuration problem.

Answer 2

yes they are, thats why webservers usually also have a "dont follow symlinks" configuration or at least a "only follow symlinks of target with same user" Thats because webserver/php usually does run with more rights then you should have access to.

And as webservers usually try to avoid things like visible /etc/shadow, it is for magento templates even more dangerous, as templates get parsed via include() so you have possible very strong security leaks if you dont have full controll over your files.

You may argue, that there are other problems then, but who does really know every potential attack scenario, and most times its the combination of different less problematic security holes, which lead to the big breaks.

Also, there was some time ago a security fix regarding media directory and symlinks, so you should look there for possible attack scenarios.

Answer 3

I can only imagine this being a risk on shared hosts, which shouldn't be used for eCommerce in the first place.

Answer 4

Magento patch SUPEE-9767 includes APPSEC-1281: Remote code execution through symlinks, so yes, Symlinks on templates are a security problem.

Type:
Remote Code Execution (RCE)

CVSSv3 Severity:
8.8 (High)

Known Attacks:
Yes. Attackers are disabling a configuration protection after gaining admin access and are uploading malicious code.

Description:
Use of the AllowSymlinks option in configuration settings can enable the upload of an image that contains malicious code. Although this option is disabled by default, an attacker with access to store configuration settings can enable it and remotely execute code.

Product(s) Affected:
Magento CE prior to 1.9.3.3, and Magento EE prior to 1.14.3.3

Fixed In:
CE 1.9.3.3, EE 1.14.3.3, SUPEE-9767

Reporter:
Wilko Nienhaus

Answer 5

Not recommend to allow. I was facing js loading errors while symlinks enabled.
Lots of;

TypeError: $.widget is not a function

I have to do try 4-5 refresh for successfuly loaded pages.
After closing it, may be not deployed resources loads slowly for first time but js errors gone.

PS: After disabling symlink, you have to delete deployed copy of files after every change for static.php re-copy it for you.