PCI Scan – Plesk PHP easter egg issue

If your PCI scan reports the following:

Port: 8443

Synops is: The configuration of PHP on the remote host allows disclosure of sensitive
information.

Description: The PHP install on the remote server is configured in a way
that allows discloure of potentially sensitive information to an attacker through a
special URL. Such an URL triggers an Easter egg built into PHP itself. Other such
Easter eggs likely exist, but SMetrics has not checked for them. See also:

http://www.0php.com/php_easter_egg.php
http://seclists.org/webappsec/2004/q4/324

Solution: In the PHP configuration file, php.ini, set the value for ‘expose_php’ to ‘Off’ to disable this behavior. Restart the web server daemon to put this change into effect.

Risk Factor: Medium / CVS S
Base Score: 5.0 (CVS S 2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
Other references: OS VDB:12184 (46803)

Now there solution is set the value for ‘expose_php‘ to ‘Off‘ in php.ini so you would think changing expose_php in /etc/php.ini would work. No, if you notice the port above it is complaint about plesk (8443) and until now I did not know plesk had it’s own php.ini file.

So if you edit:

vi /usr/local/psa/admin/conf/php.ini

and set

expose_php = Off

And then restart plesk

service psa restart1

Related Posts

  1. PCI Compliance for Plesk (linux)
  2. PCI Compliance Expect Header Cross-Site Scripting Vulnerability (8443, plesk)
  3. Upgrading PHP on a windows plesk server