Details
A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area.
When web scripts are executed and symbolic links are allowed, the web user could be allowed to access locations on the web server that are outside the scope of the web document root or home directory.
If symbolic links are found in the web content directory tree, the target file or directory is outside of the web content directory tree, and file permissions allow the web user any authority less than write, then the severity level will be downgraded to CAT 2.
If symbolic links are found in the web content directory tree, the target file or directory is not outside of the web content directory tree, and file permissions allow the web user write authority, then the severity level will remain at CAT 1.
If symbolic links are found in the web content directory tree, the target file or directory is not outside of the web content directory tree, and file permissions allow the web user any authority less than write, then the severity level will be downgraded to CAT 3.
Solution
Disable symbolic links.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.
References
- 800-53|CM-7b.
- CAT|I
- Rule-ID|SV-30576r1_rule
- STIG-ID|WG360_A22
- Vuln-ID|V-2227