4

I have a Magento live site on which following files are accessible from browser

   http://www.example.com/var/export/somefile.csv 
       {somefile.csv file name may not be known publicly}
    http://www.example.com/var/log/exception.log
    http://www.example.com/var/log/system.log
    http://www.example.com/.gitignore

What kind of security related issues can arise because of these? Can some one provide expert opinion?

Note:(Update) 1) Entire var folder is not publicly accessible, specific files are only accessible.

2) What if "somefile.csv" is a product feed file.

4

The first thing that comes to mind is that stack traces for any errors are going to show up in system.log as well as exception.log. Those stack traces would reveal your file structure/file paths as well as potentially database information that could then potentially be exploited. In general, you don't want that information available to the public because it makes hackers lives easier since they already know things like your doc root path. From there, in the case of Magento, they would know where to start checking for things to exploit that they otherwise wouldn't have known.

  • Please check updated question. – Mukesh Sep 3 '15 at 16:54
  • What about .gitignore file? – Mukesh Sep 4 '15 at 14:25
1

Is it the whole var folder that is accessible, or just the three files you've mentioned? I will assume it's the latter.

I don't know what you export to your CSV, so I won't comment on that. Regarding the logs, I think it's a really bad idea. You don't know what modules output to logs, it could unveil some really sensitive parts of your site, like login credentials or even worse, credit card details.

  • Please check updated question. – Mukesh Sep 3 '15 at 16:53
  • A product feed file isn't a big issue. – Mayers Sep 3 '15 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.