Why is Source Code Disclosure dangerous?

Source code often contains some form of sensitive information—whether it be configuration related information (e.g. database credentials) or simply information on how the web application functions. If disclosed, such information can potentially be used by an attacker to discover logical flaws and escalate into a subsequent chain of attacks which would not be possible without having access to the application’s source code. These may include attacks such as, SQL injection, database take overs and remote code execution.

It is common practice for web applications to serve non-HTML files, such as PDFs, image files and Word documents that are customized for a specific user.

Let’s take the below example where we have a simple web application http://www.example.com/. This web application is intended to allow users to download a PDF file through a hyperlink.

If we take a closer look, following the link makes an HTTP GET request to a download.php script which makes use of the filename parameter.

More specifically, the following request is sent when the link is clicked – http://www.example.com/download.php?filename=aboutus.pdf

Knowing this, we can take a closer look at the the filename parameter since it seems that the download.php script is designed to allow users to download a specific file from the server. Therefore, what would happen if we sent a request to download.php, passing ‘download.php’ as the value for the filename parameter instead of ‘aboutus.pdf’? The resulting URL would look as follows — http://www.example.com/download.php?filename=download.php

After sending the request, the file download.php is served to the browser, effectively revealing the source code of download.php and by looking through the source code, it’s evident that this occurred because the script is performing absolutely no user input validation.

<?php

// Import global config values
include('admin/config.php');

// Get the filename passed by the user
$filepath = $_GET['filename'];

if ($filepath) {
    $connection = mysql_connect($cfg['DATABASE']['HOST'], $cfg['DATABASE']['UNAME'], $cfg['DATABASE']['PASS']);

    mysql_select_db('logs', $connection);

    if (!link) {
        die('Could not connect: ' . mysql_error());
    }

    $user_agent = $_SERVER['HTTP_USER_AGENT'];

    // Used by stats.php to track download trends
    $sql = "INSERT INTO stats VALUES ('$filepath', now(), '$user_agent')";

    $result = mysql_query($sql, $connection);

    if (!$result) {
        echo 'DB Error: ' . mysql_error($connection);
        exit;
    }

    // Clean-up and send file
    mysql_close($connection);
    header('Content-Disposition: attachment; filename=' . basename($filepath));
    readfile($filepath);
}