P017R
Limit PHP Entrypoints
Description
On Magento sites, an NGINX setting was enabled by default to allow any PHP file to be used as an entry point. Ideally, only Magento's own entry points, such as index.php, should be publicly reachable. That setting is an unnecessary attack surface because any .php file in the site's web root, including unexpected uploads, could be executed. This patch removes that setting so only Magento's expected entry points can execute PHP. Legitimate Magento traffic is unaffected because it already goes through those standard entry points.
Warning
If you have a non-standard configuration and your site loads from files other than index.php, this patch might break functionality. Standard Magento sites allow traffic through index.php and the other built-in entry points, so this only affects sites that were set up to run a custom .php file directly.
If this situation does affect your deployment, please reach out to support@jetrails.com and we will work with you to mitigate any impact.
Impact
There is no downtime. The NGINX configuration is checked and then reloaded on the web nodes, which briefly resets connections on each node as it reloads.
Changes
- Removes the config that let any PHP file run as an entry point on your Magento sites.
- Makes sure new sites created on this deployment don't reintroduce it.
- Checks the NGINX configuration and reloads it on the web nodes.
If You Accept
Only Magento's standard entry points can execute PHP, so a stray .php file in the web root can't be run directly. Your normal site traffic is unaffected. If a site relied on running a custom standalone .php file, that would need to be allowed back explicitly.
If You Reject
Any PHP file present in the site's web root can still be executed directly, which leaves an unnecessary way for planted or uploaded code to run.