5

Just as the title says, we have a website that uses third party smtp credentials to send emails, but, we keep getting our smtp credentials hacked and used to send spams emails, which results in our smtp account suspension, we first used ses, and then figured that we need to add spf,dkim and dmarc, after we added them, we moved to sendgrid, got hacked again, teammates think it is because of weak password to access sendgrid, but i do not think so, because password test says it is strong and requires 2 thousand years to crack, we do not really know the problem, we are using laravel 7 for our website, how is the hacker able to access .env file ?

Help, please.

9
  • 2
    is the .env file and that file is part of your deployment? is it in a public folder? if not, does your application for example include another files, can it access files outside of its folder? if it is in the app environment and the app allows some cross-site scripting access it may allow either directly printing the environment in the page or include the .env file to a page and read it that way. if possible, let you try to implement some xss precautions (limit app access), let you store the password encrypted and decrypt it on the fly. make sure you have good perms everywhere. Nov 3, 2020 at 14:51
  • Hi, Thank you for commenting, how can i test and see if i can access the file from outside ?
    – logax
    Nov 3, 2020 at 15:00
  • @PetrChloupek can you please show me how to test this ? i do not know alot about security.
    – logax
    Nov 3, 2020 at 15:16
  • maybe, let you start with the webserver logs. it can be an url like /images/../../../../.env or also /app/controller/../../.env if you have some url rewriting or view.php?file=../../../.env, it can be more complicated. just look for some things which should not be there. remove all the lines which are regular and look at the rest. Nov 3, 2020 at 15:19
  • the .env file is not in the public folder, i read online that if it is not there then it is ok, but the problem is that the .env file has a 777 permission :O, i do not know who set this, i never set 777 to files, can that be the problem ? i tried looking into the files for a pattern that has .env, but all i find is 404 (probably me trying to test access to the .env file from the url).
    – logax
    Nov 3, 2020 at 16:21

2 Answers 2

3

Are you using nginx? I had the same issue. Following the tip of @PetrChloupek, I analysed the access logs (/var/log/nginx/access.log) and found out that sometimes an agent could get a 200 out of "/.env". It turned out that the configuration of the nginx was so that when using just the ip (v.g. 12.244.21.21 instead of "mywebsite.com") the malicious agent hitted the /var/www/html and not the public folder, as specified in the nginx conf file, since this dealt only with the specified host (v.g."mywebsite.com").

2
  • yup, that was my problem, there is an easy command that can get your .env file quite easily, bots love it, to fix the problem, i just made a policy to refuse every demand for a file that starts with a dot.
    – logax
    Jun 3, 2021 at 17:30
  • Good. Just to be precise: you have made this rule in the most general file (like at /etc/nginx/sites-available/default). Because I had the rule of refusing all demands for files that start with dot, but only applicable to one host (v.g. mywebsite.com) and not to all demands (default_server), that's why they could fetch the my .env.
    – hudata
    Jun 6, 2021 at 19:12
1

There is a known issue with developers leaving APP_DEBUG = true on live systems, this means you can trigger a debug page output that contains the .env keys and values.

https://www.mailgun.com/blog/a-word-of-caution-for-laravel-developers/

An easy way to trigger the issue, if vulnerable, is make an unsupported request, e.g. a POST / PUT request to a known GET route such as the site index '/', this will in cases where DEBUG is set to true output all the envrionment variables.

2
  • 1
    Yea, i knew of this at that time, and it wasn't the issue, my issue was that there is an easy command that can get your .env file quite easily, bots love it, to fix the problem, i just made a policy to refuse every demand for a file that starts with a dot.
    – logax
    Jun 3, 2021 at 17:31
  • Make sense! In this we need to hide the .env file and set it to APP_DEBUG = false Any other things needs to take care? Feb 6, 2022 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .