Directory Listing of Sensitive Files

Description

Directory listing of sensitive files occurs when directory listing, if enabled, exposes the complete index of resources within a directory to potential attackers. This can lead to unauthorized access to sensitive files and directories, potentially exposing confidential information or critical system files.

Recommendation

To prevent directory listing of sensitive files:

• Create a default index file (e.g., index.html) within directories to serve as the entry point.
• Disable directory listing in the web server configurations to prevent the exposure of directory contents.

References

• CWE-200
• CWE-548
• OWASP 2021-A5