cis-apache24-3-13

name	cis-apache24-3.13
description	Ensure Access to Special Purpose Application Writable Directories is Properly Restricted
category	cis-apache
version	2.3.0
author	cyberstrike-official
tags	["cis","apache","linux","privileges","permissions","ownership"]
cis_id	3.13
cis_benchmark	CIS Apache HTTP Server 2.4 Benchmark v2.3.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

3.13 Ensure Access to Special Purpose Application Writable Directories is Properly Restricted

Profile Applicability

• Level 1

Description

When the Apache webserver includes application software such as PHP, Java and many others, it is common for the application to require a writable directory. The writable directory may be needed for file uploads, application data, user session state information or many other purposes. It is important such directories have a single purpose, and have access properly secured to prevent a variety of possible exploits. The directory should be:

• Single Purpose Directory
• Outside the Configured Web DocumentRoot
• Owned by the root User or an Administrator Account
• Not writable by Other

Rationale

The following provides the rationale for each requirement on the application writable directory:

• Single Purpose Directory - Each writable application directory should have a single purpose. For example, mixing file uploads in the same directory with session tracking information would be an obvious vulnerability, as users could create session information, to hijack a manufacturer authenticated sessions.
• Outside the Configured Web DocumentRoot - The directory should NOT be under the configured DocumentRoot directory as such directories are browsable by default, and might allow unintended web read access. With web read access an attacker could upload malicious content, and then references the content in a URL exploiting the trust that users have in the website.
• Owned by the root User or an Administrator Account – The directory should be owned by root or a designated administrator to prevent unintended changes to the permissions.
• Not Writable by Other - The write access can be provided through the group permissions to the configured Apache group rather than allow write access to Other / all users. The group write access should implement the least privileges necessary in order prevent unintended access to the directory. If the application requires more complex write access, such as to specific accounts or for multiple groups, usage of an access control lists (ACL) is recommended. ACL's are supported by most Linux file systems, and can be enabled when the file system is mounted.

Audit

Perform the following to determine if the recommended state is implemented:

1. Single Purpose Directory - For each application writable directory review the documented purpose for the directory to confirm the directory serves a single purpose.
2. Outside the Configured Web DocumentRoot - For each writable directory and it's corresponding DocumentRoot perform the following. No output from the find command indicates the directory is not within the DocumentRoot.