Psalm Config Exposure Scanner

Psalm is a popular static analysis tool used primarily by PHP developers to identify potential problems in their codebases. It is widely used in various environments, from individual developers seeking code quality improvements to large enterprises enforcing coding standards across teams. The tool integrates seamlessly with continuous integration systems, making it a favorite among DevOps engineers. Its configuration files are often stored on servers to maintain consistency across builds and scans. Being an open-source project, Psalm receives contributions from developers worldwide, ensuring it remains up-to-date with the latest PHP standards. Its versatility and robustness make it an indispensable part of the software development lifecycle in PHP projects.

Configuration exposure vulnerabilities, like the one detected in Psalm, can inadvertently reveal sensitive information about the software's setup and internal structures. When exposed, these configurations might provide insights into directory paths, the structure of the codebase, or other operational aspects that should remain confidential. Such exposures typically arise from improper server configurations or mismanaged permissions, leaving configuration files accessible to unauthorized users. Attackers can leverage this information for further exploitation, potentially targeting other vulnerabilities or weaknesses uncovered in the exposed configuration. This vulnerability highlights the importance of securing sensitive files and ensuring that access is restricted to authorized personnel only. The risk lies not just in immediate exposure but in providing a roadmap for attackers to navigate the system's defenses.

The Psalm configuration exposure involves the unintended accessibility of the psalm.xml file on a server. This file contains critical information about the static analysis setup, including project file references and potentially specific rules applied during analysis. The endpoint typically leveraged by attackers would be the base URL where the psalm.xml file is stored, often at a predictable or default location. Because this file is expected to be in XML format, the response header confirming "application/xml" can indicate its presence. Additionally, specific XML tags, such as '<psalm>' and '<projectFiles>', are key markers in identifying the file as a Psalm configuration. This exposure underlines the necessity for proper file access controls and ensuring that configuration files are not publicly accessible.

Exploitation of the Psalm configuration exposure can lead to several potential security risks. With access to the psalm.xml file, attackers might discern the structure of a project and gain insights into how code is analyzed, allowing them to craft more effective attacks. This information can be particularly valuable when attempting to penetrate systems where the source code is closely guarded. Additionally, any custom configurations or particular paths revealed in the file can guide an attacker in locating other sensitive files or system weaknesses. Exposure also raises the risk of disclosing which security checks are enabled or bypassed, giving adversaries crucial knowledge to evade detection. Ultimately, an exposed configuration file can compromise the integrity of the static analysis process and provide a foothold for more extensive system intrusions.

REFERENCES

• https://psalm.dev/docs/running_psalm/configuration/