Security: Potential Information Disclosure via phpinfo() Endpoint#1003
Security: Potential Information Disclosure via phpinfo() Endpoint#1003tomaioo wants to merge 1 commit into
Conversation
The PageController exposes a phpinfo() endpoint that renders PHP configuration details when enabled via app config. While protected by a config flag, if enabled, phpinfo(INFO_ALL & ~INFO_ENVIRONMENT & ~INFO_VARIABLES) still exposes extensive server information including loaded extensions, compilation options, and server paths. This could aid attackers in reconnaissance. The PhpInfoResponse class sets ContentSecurityPolicy and FeaturePolicy but the raw phpinfo output still contains sensitive data. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
|
Thanks for your pull request 👍
The endpoint is only accessible to administrators already. |
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
2 participants
Summary
Security: Potential Information Disclosure via phpinfo() Endpoint
Problem
Severity:
Medium| File:lib/Controller/PageController.php:L47The PageController exposes a phpinfo() endpoint that renders PHP configuration details when enabled via app config. While protected by a config flag, if enabled, phpinfo(INFO_ALL & ~INFO_ENVIRONMENT & ~INFO_VARIABLES) still exposes extensive server information including loaded extensions, compilation options, and server paths. This could aid attackers in reconnaissance. The PhpInfoResponse class sets ContentSecurityPolicy and FeaturePolicy but the raw phpinfo output still contains sensitive data.
Solution
Consider removing or heavily restricting this endpoint. If needed for debugging, require admin authentication and log access. Evaluate if the INFO_MODULES flag might still expose sensitive extension versions.
Changes
lib/Controller/PageController.php(modified)