CWE-219, Storage of File with Sensitive Data Under Web Root, means the product keeps sensitive data inside the web document root without enough access control, so untrusted parties may be able to fetch it.
MITRE points out that besides public pages and code, products often leave sensitive data, code that is not meant to be invoked directly, and other files under the document root. If the server is not set up to block direct access, an attacker can request them by URL.
How it happens
A developer puts a data file, backup, config or database next to the pages that use it because it is convenient. The web server serves whatever is in the root unless told otherwise. MITRE's observed examples:
- CVE-2002-1449: a username and password in a data file under the web root.
- CVE-2002-0943: a database file under the web root.
- CVE-2005-1835 and CVE-2005-2217: data files under the web root.
What an attacker gains
MITRE lists confidentiality: reading application data. A fetched database or credential file can be the whole breach.
How to find it
MITRE lists no detection methods. Check for it directly:
- List the files under each document root and flag anything that is not meant to be public: databases, dumps, backups, .env files, config, logs.
- Request those paths from outside, without logging in.
- Run a dynamic scan against the deployed site, which tries common file names for you.
How to fix it
MITRE gives two mitigations:
- Avoid storing information under the web root. Keep data and configuration in a directory the server does not serve.
- Set access control permissions to prevent reading or writing of sensitive files inside or outside the web directory.
# Defence in depth: refuse common sensitive extensions
location ~* \.(sqlite|db|bak|sql|env|log)$ {
deny all;
}
This is a backstop. The real fix is moving the files out of the served directory.
Quick check
Is an unlinked file safe under the web root?
No. If the server serves it and the name can be guessed or found, it can be fetched.
