contao/core — Issue #4049: CHANGELOG in Webroot
Author: daschl
Created: 2012-03-06 11:47:00+00:00
State: open

Hi Community,

I'd like to raise your attention again to a information leak issue that has already been brought up three months ago but was closed by leo.

In my opinion, it is not enough to just say that the file should be removed, since - lets be honest - noone does this by default. Nearly all apps have them in place and therefore make it very easy to fingerprint the application.

http://www.contao.org/CHANGELOG.md is also in place.

This is not a security issue in its basic sense, but it allows an attacker to easily fingerprint the contao version and therefore pinpoint any vulnerabilities from the past.

The easiest way would be to make it non-accessible, but this won't work on windows platforms of course (but is better than nothing).

In my opinion, the safest approach is to move the index.php (like many web frameworks do) and all needed assets to a dedicated webroot folder and let the server config point there (or reroute it via .htaccess).

Regards,
Michael