Description
Magento Cacheleak is an implementation vulnerability, result of bad implementation of web-server configuration for Magento platform. Magento was developed to work under the Apache web-server which natively works with .htaccess files, so all needed configuration directives specific for various internal Magento folders were placed in .htaccess files.
When Magento is installed on web servers that are ignoring .htaccess files (such as nginx), an attacker can get access to internal Magento folders (such as the Magento cache directory) and extract sensitive information from cache files.
Remediation
Restrict access to internal Magento directories such as /var/, /app/, /includes/, ...
Consult web references for more information.
Add the following lines to your nginx server configuration:
location ^~ /app/ { deny all; } location ^~ /includes/ { deny all; } location ^~ /lib/ { deny all; } location ^~ /media/downloadable/ { deny all; } location ^~ /pkginfo/ { deny all; } location ^~ /report/config.xml { deny all; } location ^~ /var/ { deny all; }
References
Related Vulnerabilities
WordPress Plugin Ultimate Addons for Elementor Security Bypass (1.24.1)
WordPress Plugin WP Migrate DB Security Bypass (0.6)
WordPress Plugin Fast Secure Contact Form Remote Code Execution (4.0.44)
WordPress 4.0.x Same Origin Method Execution (SOME) Vulnerability (4.0 - 4.0.10)
WordPress Plugin Profile Extra Fields by BestWebSoft Cross-Site Scripting (1.0.7)