kolbyjack / docker-dokuwiki Goto Github PK

Hi,

I'm a security researcher. Thank you for providing this useful docker image! After I set it up, I found your docker image disclose some sensitive directories and files to public:
inc/
bin/
vendor/.htaccess.dist
/bin/.htaccess
/inc/.htaccess
/vendor/.htaccess

All these files should not be expose as warned in https://www.dokuwiki.org/security. The bin/ direcotry contains executables that may be exploited by attackers if they get its contents. Specially, the .htaccess files can be used in web-based exploitation, as mentioned in https://www.acunetix.com/vulnerabilities/web/htaccess-file-readable/. They use this file to hide malware, to redirect search engines to their own sites, and for many other purposes (hide backdoors, inject content, to modify the php.ini values, etc).

Would it be better to block these access in your docker image? Thanks!

Best,
-ct