php-config-audit

PHP Configuration Security Audit (php-config-audit)

Analyze PHP project configuration and runtime settings, and detect security-related configuration defects:

• CORS too permissive (allowing all origins, improper credentials combinations)
• Error and debug information exposure (display_errors, debug mode, unhidden stack traces)
• Missing security response headers (CSP, X-Frame-Options/Frame-Options, Referrer-Policy, HSTS, etc.)
• Dangerous PHP/runtime switches (such as allow_url_include、file_uploads and other dangerous combinations linked to business logic)
• Accessible/executable properties of upload/download directories (output evidence if it can be inferred from configuration)

Severity ratings and numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-CFG-{序号}

Mandatory evidence (required)

Evidence paths must be provided for each issue:

• Configuration file/environment variable location (for example .env、config/*.php/yaml、php.ini、Dockerfile/entrypoint）
• Runtime setting code location (ini_set、set_exception_handler, response header middleware)
• Impact point: which routes/responses are affected by this configuration (must be associated with at least one type of entry point/response chain)

Exploitability and preconditions (required)

• Error exposure: whether sensitive information is leaked and exploited by attackers (for example, combined with arbitrary file read/SQLi for escalation)
• CORS: whether there is a victim browser scenario and credentials combination
• Missing security headers: whether they can be exploited in a chain with XSS/clickjacking

PoC (required)

An observable PoC must be provided (for example curl -i) or request steps:

• Trigger the response using a real route
• Show evidence of missing/incorrect response headers or stack trace output

Evidence references (mandatory: static evidence preferred, trace optional enhancement)

CFG belongs to the non-trace-gate category: Configuration security audit uses static configuration file/code evidence as the primary basis, not php-route-tracer trace-gate or ## 9) Sink Evidence Type Checklist as a mandatory prerequisite threshold. If CFG line evidence exists in trace output, it can be used as an enhanced reference.

The following evidence must be provided for each suspected configuration security risk (source is static code/configuration files, trace can be used as enhancement):

1. EVID_CFG_CONFIG_LOCATION: Configuration file/environment variable location evidence (for example .env、config/*.php/yaml、php.ini、Dockerfile/entrypoint）
2. EVID_CFG_RUNTIME_SETTING_CODE: Runtime setting code location evidence (ini_set/set_exception_handler/response header middleware, etc.)
3. EVID_CFG_IMPACT_ASSOCIATION: Impact point association evidence (which routes/responses are affected by this configuration)
4. EVID_CFG_SECURITY_SWITCH_EVIDENCE: Key configuration evidence such as security headers/error exposure/CORS/dangerous switches

Handling of missing evidence (mandatory, following the unified standard)

• Configuration items can be directly evidenced from static files and do not depend on trace completeness.
• If the static evidence in 1~4 above is complete and the impact path is clear: ✅已确认可利用 or 🟡高概率。
• If the key impact point association (3) is missing (unable to confirm which entry points/responses are affected): downgrade to ⚠️待验证。

Report output

{output_path}/vuln_audit/cfg_{timestamp}.md