Risk: Low 4.3 Low CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

phpinfo() Exposure: Preventing Server Environment and Module Leaks

The phpinfo() diagnostic function outputs an exhaustive report detailing PHP engine settings, installed modules, filesystem paths, and environment variables.

Diagnostic files like info.php or phpinfo.php left by developers provide adversaries with complete reconnaissance data for targeting known CVEs in specific module versions.

Vulnerability Risk & Threat Impact

Disclosing exact runtime versions, extension sets, and operating system paths streamlines targeted exploit selection.

Attack Vector: Automated botnets continuously harvest public endpoints matching this signature. Once discovered, exploitation is triggered automatically without human review.

How Our Scanner Inspects for This Flaw

Site Check checks for common diagnostic filenames (info.php, phpinfo.php, test.php) returning HTTP 200 with PHP configuration data.

Diagnostics of transport security and HTTP response policies parse security headers returned by the origin server. The scanner checks for Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and robust cookie protection attributes (HttpOnly, Secure, SameSite).

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

Deleting diagnostic phpinfo scripts

      # Remove diagnostic scripts from web root:
rm -f /var/www/html/info.php /var/www/html/phpinfo.php

Delete all phpinfo test scripts from production web directories.
Disable the phpinfo() function in php.ini via the disable_functions directive.

Attack Anatomy & Real-World Business Impact

Public info.php diagnostics expose exact PHP module builds, filesystem paths, and environment variables, equipping attackers with precise version vulnerability intelligence.

Financial & Legal Liability Risks: Exploitation of the phpinfo exposure attack vector enables unauthorized perimeter traversal, exposure of sensitive telemetry, and compromise of user sessions.

Compliance Framework Impact: Violation of fundamental security controls specified in OWASP Top 10 (A05:2021 Security Misconfiguration), SOC 2 Type II trust criteria, and ISO 27001 Annex A.

Defense-in-Depth Engineering Matrix

Defense Layer	Technical Action	Tool / Enforcement
Edge Perimeter & Ingress Gateway	Enforce granular path restrictions and deny rules for routes matching phpinfo-exposure	Nginx Ingress Directives
Application Runtime Hardening	Disable verbose runtime telemetry and enforce least privilege controls for phpinfo-exposure	Runtime Configuration Hardening
CI/CD DevSecOps Automation	Incorporate automated verification gates for phpinfo-exposure within continuous deployment pipelines	Site Check Security Scanner

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

Bash / cURL: Diagnostic Endpoint Verification

curl -s https://your-domain.com/info.php | grep -i "PHP Version"
# Expected: 404

DevSecOps Best Practices & CI/CD Hardening

Purge test scripts from production directories and set disable_functions = phpinfo in php.ini.

Frequently Asked Remediation Questions

How rapidly do malicious botnets probe for phpinfo exposure?

Automated internet-wide port scanners and crawlers identify exposed public endpoints within hours of DNS propagation.

Does resolving phpinfo exposure mandate infrastructure downtime?

No. Most web server rule adjustments and configuration updates take effect instantly via zero-downtime service reloads.

Application Security Lead Auditor Assessment

Properly configured security headers establish browser-enforced defense-in-depth for all visitors. The absence of modern CSP and HSTS leaves client sessions susceptible to Clickjacking, protocol downgrade eavesdropping, and MIME-type confusion attacks.

To permanently close the «phpinfo() Exposure: Preventing Server Environment and Module Leaks» threat vector, integrate verification gates into your CI/CD pipeline and maintain automated perimeter checks with Site Check.