WG360 A22 - Symbolic links must not be used in the web content directory tree - find

Information

A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area.

When web scripts are executed and symbolic links are allowed, the web user could be allowed to access locations on the web server that are outside the scope of the web document root or home directory.


If symbolic links are found in the web content directory tree, the target file or directory is outside of the web content directory tree, and file permissions allow the web user any authority less than write, then the severity level will be downgraded to CAT 2.

If symbolic links are found in the web content directory tree, the target file or directory is not outside of the web content directory tree, and file permissions allow the web user write authority, then the severity level will remain at CAT 1.

If symbolic links are found in the web content directory tree, the target file or directory is not outside of the web content directory tree, and file permissions allow the web user any authority less than write, then the severity level will be downgraded to CAT 3.

Solution

Disable symbolic links.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_UNIX_V1R11_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CAT|I, Rule-ID|SV-30576r1_rule, STIG-ID|WG360_A22, Vuln-ID|V-2227

Plugin: Unix

Control ID: 38d9fb832a1a3894dea450f229bdf805503a724de9d8ffc358eac9788fafad05