Good old server-status, which is switched on an open to all in the default httpd.conf in Apache. Taken alone this isn't much to worry about - it is unwanted in

Good old server-status, which is switched on an open to all in the default httpd.conf in Apache. Taken alone this isn't much to worry about - it is unwanted information spillage. But it gives away enough information that could be useful as part of another attack. Since it logs URLs being hit, it can show private URLs - such as those that depend on randomly generated tokens to access data (eg. photobucket photos) or to determine the structure of a backend admin app. It can also expose sessions in apps that use tokens in URL query parameters where cookies are not allowed (ironically something that older versions of PHP did by default). It is also useful in measuring the progress of a DoS attack, especially with slorloris[1]. All of the standard web security scanners check for this page, and rate the severity of the information leak as moderate. What is surprising here is that it hasn't been discovered earlier, considering how often large sites such as php.net would be scanned by such scanners. That would suggest that this is a temporary configuration glitch, or something that they don't mind being publicly accessible due to the type of content hosted on php.net and the fact that it is mirrored by volunteers anyway. It would be much more interesting if this happen to, say, Twitter. It did, and I wrote about it at the time (I got a bit carried away, cringe: http://techcrunch.com/2009/10/21/twitter-you-say-transperancy-i-say-vulnerability/ http://techcrunch.com/2009/10/21/twitter-you-say-transperanc... They closed it up quickly. To disable it, remove all reference to mod_status[2] in your config: # LoadModule status_module libexec/apache2/mod_status.so Also the related server_info[3] module: # LoadModule info_module libexec/apache2/mod_info.so If you want to keep the status page, lock it down by IP (and change the default URL): <Location /_status> SetHandler server-status Order deny, allow Deny from all Allow from localhost your-host-or-ip.com </Location > You can also add simple http auth just as you would in any other Location or Directory directive[4]. While you are at it, remove the server signature, which gives away a lot of information in terms of modules enabled and version numbers: ServerSignature Off Same with extended status: ExtendedStatus On In short, not that big a deal, but could be a big deal on certain websites and it is something that admins should check for and lock down if they are running apache. [1] http://ha.ckers.org/slowloris/ http://ha.ckers.org/slowloris/ [2] http://httpd.apache.org/docs/2.2/mod/mod_status.html http://httpd.apache.org/docs/2.2/mod/mod_status.html [3] http://httpd.apache.org/docs/2.2/mod/mod_info.html http://httpd.apache.org/docs/2.2/mod/mod_info.html [4] http://doc.norang.ca/apache-basic-auth.html http://doc.norang.ca/apache-basic-auth.html