CakePHP Unsafe Configuration

php.cakephp_unsafe_configuration

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

Php

Description

Unsafe configurations in CakePHP can lead to security vulnerabilities.

Some of the CakePhp configurations may lead to security vulnerabilities:

Here is a vulnerable code example for CakePHP:

<?php
    use Cake\Core\Configure;

    Configure::write('debug', 3);  // FLAW
    Configure::write('Security.level', 'low'); // FLAW
?>

In the code above, both debug and Security.level are not used properly.

Also, this is configurable in the config/app.php file for CakePHP:

<?php
return [
    'debug' => true, // FLAW

    'Security' => [
        'salt' => '__SALT__',
        'level' => 'low'  // FLAW
    ],
];

The sanitized version of the previous example would look like this:

<?php
return [
    'debug' => false,

    'Security' => [
        'salt' => '__SALT__',
        'level' => 'medium'
    ],
];

The detector has the following configurable parameters:

checkDebug, that indicates if the debug configuration must be checked.
checkSecurityLevel, that indicates if the Security.level configuration must be checked.