4

I have a Magento live site on which following files are accessible from browser

   http://www.example.com/var/export/somefile.csv 
       {somefile.csv file name may not be known publicly}
    http://www.example.com/var/log/exception.log
    http://www.example.com/var/log/system.log
    http://www.example.com/.gitignore

What kind of security related issues can arise because of these? Can some one provide expert opinion?

Note:(Update) 1) Entire var folder is not publicly accessible, specific files are only accessible.

2) What if "somefile.csv" is a product feed file.

2 Answers 2

4

The first thing that comes to mind is that stack traces for any errors are going to show up in system.log as well as exception.log. Those stack traces would reveal your file structure/file paths as well as potentially database information that could then potentially be exploited. In general, you don't want that information available to the public because it makes hackers lives easier since they already know things like your doc root path. From there, in the case of Magento, they would know where to start checking for things to exploit that they otherwise wouldn't have known.

2
  • Please check updated question.
    – Mukesh
    Sep 3, 2015 at 16:54
  • What about .gitignore file?
    – Mukesh
    Sep 4, 2015 at 14:25
1

Is it the whole var folder that is accessible, or just the three files you've mentioned? I will assume it's the latter.

I don't know what you export to your CSV, so I won't comment on that. Regarding the logs, I think it's a really bad idea. You don't know what modules output to logs, it could unveil some really sensitive parts of your site, like login credentials or even worse, credit card details.

2
  • Please check updated question.
    – Mukesh
    Sep 3, 2015 at 16:53
  • A product feed file isn't a big issue. Sep 3, 2015 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.