The Dangers of Exposing php.ini and wp-config.php Configuration Files in PHP Web Applications

It's year 2023.

However, you would be surprised how many database credentials are exposed on PHP based web applications just by simply googling specific terms.

PHP is a widely used programming language for web application development. Among PHP applications, WordPress is a popular content management system (CMS) used by millions of websites worldwide.

Two crucial components of PHP applications and WordPress installations are the php.ini and wp-config.php files, respectively.

These files contain essential configuration settings for the PHP environment and the WordPress installation. When deploying a PHP web application or WordPress site to a server, it is vital to ensure that these configuration files are secure and not publicly exposed. In this article, we will discuss the risks associated with publicly accessible php.ini and wp-config.php files and how to avoid them.

The Dangers of a Publicly Exposed php.ini and wp-config.php Files

Information Leakage

Publicly exposed php.ini and wp-config.php files can reveal sensitive information about your server, PHP environment, and web application, including WordPress-specific details. This information can be exploited by malicious actors to identify potential weaknesses and vulnerabilities in your setup.

For instance, attackers can learn about:

• Server paths and directory structures
• Enabled and disabled PHP functions
• Extension configurations
• Error reporting and logging settings
• WordPress database credentials, table prefix, and secret keys
• Unauthorized Modifications

If the php.ini or wp-config.php file is exposed and writable, attackers can modify their settings to manipulate the behavior of your web application or WordPress site.

This can lead to:

• Disabling security features, such as turning off error reporting or enabling dangerous PHP functions
• Changing resource limits to cause resource exhaustion or server crashes
• Enabling or disabling extensions, which can affect the functionality of your application
• Modifying logging settings to cover their tracks or store sensitive information
• Gaining unauthorized access to your WordPress database
• Attack Vector Discovery

A publicly exposed php.ini or wp-config.php file provides attackers with information on how to exploit known and unknown vulnerabilities in your PHP environment or WordPress installation.

This increases the risk of attacks such as:

• Remote code execution: Attackers can use the knowledge of enabled PHP functions and extensions to execute malicious code on your server
• SQL injection: By knowing the database-related configuration settings in wp-config.php, attackers can craft specific payloads to exploit SQL injection vulnerabilities
• Directory traversal: Knowledge of server paths and directory structures may help attackers exploit directory traversal vulnerabilities
• Brute-force attacks: Revealing WordPress secret keys can allow attackers to perform brute-force attacks on your website

How to Protect Your php.ini and wp-config.php Files

Restrict Access

Ensure that your php.ini and wp-config.php files are not accessible to the public. Configure your web server to deny access to these files, or place them in directories outside the web root.

For example, in an Apache configuration file, you can add the following directive:

<FilesMatch "(^php\.ini$|^wp-config\.php$)"

? ? Order allow,deny

? ? Deny from all

</FilesMatch>>
        

Set Proper Permissions

Ensure that the php.ini and wp-config.php files have the correct permissions set. These files should only be readable and writable by the owner (usually the web server user or the system administrator). Avoid using overly permissive settings like 777.

Disable Unnecessary Functions and Extensions

Review your php.ini file and disable any functions or extensions that your web application or WordPress site does not require. This can help reduce the attack surface and minimize the risk of exploitation.

Keep Your PHP Environment and WordPress Installation Up-to-Date

Regularly update your PHP installation, WordPress core, plugins, and themes to the latest stable versions. This will help protect your web application or WordPress site from newly discovered vulnerabilities.

Sites using the nginx web server may need manual configuration changes to protect such files.

Stay safe!