cis-nginx-v300-2-5-3

name	cis-nginx-v300-2-5-3
description	Ensure hidden file serving is disabled (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","information-disclosure","basic-configuration"]
cis_id	2.5.3
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 2.5.3 — Ensure hidden file serving is disabled

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

Hidden files and directories (starting with a dot, e.g., .git, .env) often contain sensitive metadata, version control history, or environment configurations. Serving these files should be globally disabled.

Rationale

Version control systems (Git, SVN) and editors create hidden files that may unintentionally be deployed to the web root. If accessible, files like .git/config or .env can leak database credentials, source code, and infrastructure details, leading to full system compromise. Blocking requests to any path starting with a dot (.) neutralizes this risk.

Impact

Blocking all dot-files will break Let's Encrypt / Certbot validation (.well-known/acme-challenge) unless explicitly allowed. Ensure the exception rule is placed before the deny rule or is more specific.

Audit Procedure

1. Check Configuration:

Search the loaded configuration for hidden file protection rules:

nginx -T 2>/dev/null | grep "location.*\\\."

Evaluation:

• Look for a block like location ~ /\. { deny all; ... }.

2. Functional Test (Recommended):

Try to access a dummy hidden file:

curl -k -I https://127.0.0.1/.git/HEAD

Evaluation:

• PASS: Returns 403 Forbidden or 404 Not Found.
• FAIL: Returns 200 OK (if file exists) or the content of the file.

Remediation

To restrict access to hidden files, add the configuration block below inside each server block.

Option A: Direct Configuration

Place this block directly into your server contexts:

# Allow Let's Encrypt validation (must be before the deny rule)
location ^~ /.well-known/acme-challenge/ {
    allow all;
    default_type "text/plain";
}

# Deny access to all other hidden files
location ~ /\. {
    deny all;
    return 404;
}