Exposed Backup Files: Preventing Database Dump and Archive Leaks

During site migrations, updates, or maintenance, engineers often generate archives of web roots or databases directly in public folders under common names like backup.zip, dump.sql, site.tar.gz, or old.rar.

Because web servers serve static files by default, anyone can download these archives via direct HTTP requests without authentication, acquiring full copies of databases and configuration files.

Vulnerability Risk & Threat Impact

Database dumps contain complete user tables, password hashes, payment records, and personal identifying information (PII), leading to catastrophic data exposure.

How Our Scanner Inspects for This Flaw

Site Check probes common archive and database dump patterns (e.g., backup.zip, 1.sql, db.tar.gz, site.zip) using lightweight HEAD requests to identify status 200 responses.

During configuration and secret scanning, the Site Check engine executes lightweight, non-destructive HEAD and GET probes evaluating status code responses (404/403 vs 200). Diagnostic queries adhere to safety bounds without caching payload contents to external storage, ensuring full confidentiality.

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

      # Block downloads of database dumps and backup archives in Nginx:
location ~* \.(sql|bak|dump|old|backup|zip|tar\.gz|rar)$ {
    deny all;
    return 404;
}
    

• Never store backup archives or database dumps in public web directories (/var/www or /usr/share/nginx/html).
• Store automated backups in isolated, encrypted cloud object storage (S3) with strict access control lists (ACLs).
• Configure web server rules to deny requests matching database and archive extensions.

Attack Anatomy & Real-World Business Impact

Text editors and operators frequently produce ephemeral archives like backup.zip, dump.sql, and database.tar.gz in the public web root. Adversaries probe standard filenames to download full database dumps without exploiting application logic.

Compliance Framework Impact: Major violation of GDPR Article 32, PCI-DSS Requirement 3 (protection of stored cardholder data), and HIPAA Security Rule specifications.

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

curl -I -s https://your-domain.com/dump.sql | grep "HTTP/"
# Expected: 404
    

DevSecOps Best Practices & CI/CD Hardening

Generate database backups exclusively in isolated paths outside the document root (/var/backups) and stream them directly to encrypted cloud object storage.