How to remediate – Directory Listing

1. Introduction

Directory Listing is a web server feature that allows users to view files and folders hosted on the server. It’s typically used for file sharing, but can expose sensitive information if enabled unnecessarily. This vulnerability affects web servers like Apache and IIS, potentially leading to data breaches or application structure discovery. Confidentiality, integrity, and availability may be impacted by unauthorized access to exposed files.

2. Technical Explanation

Directory Listing occurs when a web server is configured to display the contents of directories instead of showing an error page when no index file (like `index.html`) exists. An attacker can directly request a directory path and, if listing is enabled, view all files within that directory. This allows them to download sensitive content or map out the application’s structure.

• Root cause: Web server configuration permits directory indexing without authentication.
• Exploit mechanism: An attacker sends an HTTP request to a directory path on the web server, and receives a listing of files if enabled. For example, requesting http://example.com/private_data/ might reveal a list of sensitive files.
• Scope: Affected platforms include servers running Apache, IIS, Nginx, or other web server software with directory indexing enabled.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking the web server configuration and attempting to access directories without an index file.

• Quick checks: Access a directory on the web server that does not contain an `index.html` or similar default index file. If you see a list of files, directory listing is enabled.
• Scanning: Nessus plugin ID 10423 can detect directory listing vulnerabilities. Burp Suite’s spider can also identify exposed directories.
• Logs and evidence: Web server access logs may show requests for directory paths that result in a directory listing being served (e.g., HTTP status code 200 with HTML content containing file names).

curl -I http://example.com/private_data/

4. Solution / Remediation Steps

Disable directory listing unless it’s specifically required for sharing static, non-sensitive files.

4.1 Preparation

• Ensure you have access to modify the web server configuration file. A roll back plan is to restore the original configuration file.
• Changes may require a brief outage, so schedule during off-peak hours and obtain approval from relevant stakeholders.

4.2 Implementation

1. Step 1: Locate the web server’s main configuration file (e.g., `httpd.conf` for Apache, `web.config` for IIS).
2. Step 2: For Apache, find the `` block corresponding to the affected virtual host and ensure that `Options Indexes` is not present or is commented out.
3. Step 3: For IIS, open the Internet Information Services (IIS) Manager, navigate to the website, double-click “Directory Browsing”, and disable it.
4. Step 4: Restart the web server service to apply the changes.

4.3 Config or Code Example

Before

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>

After

<Directory "/var/www/html">
    FollowSymLinks
AllowOverride None
Require all granted
</Directory>

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Restrict access to sensitive directories and files based on the principle of least privilege.
• Secure defaults: Configure web servers with secure default settings, disabling unnecessary features like directory listing.

4.5 Automation (Optional)

Ansible can be used to disable directory browsing in IIS:

---
- name: Disable Directory Browsing in IIS
  win_feature:
    name: Web-DirectoryBrowsing
    state: absent

5. Verification / Validation

Confirm the fix by attempting to access a directory without an index file again. You should now receive an error message (e.g., 403 Forbidden) instead of a directory listing.

• Re-test: Run the initial curl command and verify that it no longer returns a list of files.
• Smoke test: Ensure other website functionality remains operational, such as accessing valid pages with index files.
• Monitoring: Check web server access logs for any unexpected requests to directory paths.

curl -I http://example.com/private_data/

6. Preventive Measures and Monitoring

• Baselines: Implement a security baseline that enforces the disabling of directory listing on all web servers.
• Asset and patch process: Regularly review web server configurations for compliance with security standards, at least quarterly.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Disabling directory listing may break functionality if it’s legitimately used for file sharing. Ensure any required applications are updated to use alternative methods.
• Roll back: Restore the original web server configuration file from backup. Restart the web server service.

8. References and Resources

• Vendor advisory or bulletin: https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing
• NVD or CVE entry: Not applicable, as this is a configuration issue rather than a specific vulnerability with a CVE ID.
• Product or platform documentation relevant to the fix: Refer to Apache’s and IIS’s official documentation for instructions on disabling directory listing.