What is Exposure of Information Through (CWE-548)?

TL;DR: Exposure of Information Through Directory Listing (CWE-548) is a security vulnerability where web applications or servers reveal directory contents, leading to potential information disclosure. To mitigate this, disable directory listings and implement robust error handling.

What is Exposure of Information Through Directory Listing?

Exposure of Information Through Directory Listing (CWE-548) is a type of vulnerability that occurs when a product inappropriately exposes a directory listing with an index of all the resources located inside of the directory. As defined by the MITRE Corporation under CWE-548, and classified by the OWASP Foundation under A01:2025 - Broken Access Control.

Quick Summary

Exposure of Information Through Directory Listing is a critical security issue where web applications or servers reveal directory contents to unauthorized users. This can lead to information disclosure, aiding attackers in understanding system architecture and identifying sensitive files. Jump to: Overview · Attack Scenario · Detection · Fix

Jump to: Quick Summary · Exposure of Information Through Directory Listing Overview · How Exposure of Information Through Directory Listing Works · Business Impact of Exposure of Information Through Directory Listing · Exposure of Information Through Directory Listing Attack Scenario · How to Detect Exposure of Information Through Directory Listing · How to Fix Exposure of Information Through Directory Listing · Framework-Specific Fixes for Exposure of Information Through Directory Listing · How to Ask AI to Check Your Code for Exposure of Information Through Directory Listing · Exposure of Information Through Directory Listing Best Practices Checklist · Exposure of Information Through Directory Listing FAQ · Vulnerabilities Related to Exposure of Information Through Directory Listing · References · Scan Your Own Site

Exposure of Information Through Directory Listing Overview

What: CWE-548 is a vulnerability where web applications or servers expose directory listings.

Why it matters: This can lead to information disclosure, aiding attackers in understanding system architecture and identifying sensitive files.

Where it occurs: Web applications and servers that do not properly handle requests for non-existent files may serve directory listings instead.

Who is affected: Applications with misconfigured web server settings or lack of proper access controls.

Who is NOT affected: Systems already using need-to-know requirements and turning off automatic directory listings.

How Exposure of Information Through Directory Listing Works

Root Cause

The root cause is the inappropriate exposure of a directory listing, which reveals file names and structures to unauthorized users.

Attack Flow

1. An attacker sends a request for a non-existent URL.
2. The server responds with an error message containing a directory listing.
3. The attacker gains insights into system architecture and identifies sensitive files.

Prerequisites to Exploit

• The web application or server must be configured to serve directory listings when requested.
• The attacker needs access to the endpoint that serves these listings.

Vulnerable Code

from flask import Flask, send_from_directory

app = Flask(__name__)

@app.route('/<path:filename>')
def serve_file(filename):
    return send_from_directory('static', filename)

This code allows any file in the static directory to be served directly. If a non-existent URL is requested, the server may respond with a directory listing.

Secure Code

from flask import Flask, abort

app = Flask(__name__)

@app.route('/<path:filename>')
def serve_file(filename):
    if not os.path.isfile(os.path.join('static', filename)):
        abort(404)
    return send_from_directory('static', filename)

This secure code checks whether the requested file exists before serving it, preventing directory listings from being exposed.

Business Impact of Exposure of Information Through Directory Listing

Confidentiality: Exposing directory contents can lead to unauthorized access to sensitive files and source code.

Integrity: Attackers may use discovered information to exploit misconfigurations or launch further attacks.

• Financial loss due to data breaches
• Compliance penalties for violating security policies
• Damage to reputation from publicized vulnerabilities

Exposure of Information Through Directory Listing Attack Scenario

1. An attacker sends a request to http://example.com/nonexistentpath.
2. The server responds with an HTTP 404 error and a directory listing.
3. The attacker identifies sensitive files in the listing.
4. The attacker uses this information to exploit further vulnerabilities.

How to Detect Exposure of Information Through Directory Listing

Manual Testing

• Send requests for non-existent URLs and check if directory listings are returned.
• Verify that error pages do not reveal file structures or paths.

Automated Scanners (SAST / DAST)

Static analysis can detect configurations that enable directory listing features. Dynamic testing is required to confirm the presence of actual vulnerabilities in a running application.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, and Nikto are effective at identifying directory listings during automated scans.

False Positive Guidance

False positives may occur if legitimate error messages or static content pages contain file paths. Ensure that these do not reveal sensitive information before marking them as false alarms.

How to Fix Exposure of Information Through Directory Listing

• Restrict access to important directories and files.
• Turn off automatic directory listings in server configurations.
• Implement proper error handling to prevent exposing file structures.

Framework-Specific Fixes for Exposure of Information Through Directory Listing

Python/Django

from flask import Flask, abort

app = Flask(__name__)

@app.route('/<path:filename>')
def serve_file(filename):
    if not os.path.isfile(os.path.join('static', filename)):
        abort(404)
    return send_from_directory('static', filename)

Java

@WebServlet("/files/*")
public class FileServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String path = req.getPathInfo();
        if (path == null || !new File("webapp/files", path).exists()) {
            resp.sendError(HttpServletResponse.SC_NOT_FOUND);
        } else {
            sendFile(req, resp, new File("webapp/files", path));
        }
    }

    private void sendFile(HttpServletRequest request, HttpServletResponse response, File file) throws IOException {
        // Send the file
    }
}

Node.js

const express = require('express');
const app = express();

app.get('/files/:filename', (req, res) => {
    const path = req.params.filename;
    if (!fs.existsSync(`./static/${path}`)) {
        res.status(404).send('File not found');
    } else {
        res.sendFile(path.join(__dirname, `../static/${path}`));
    }
});

PHP

<?php
if (isset($_GET['file'])) {
    $filename = $_GET['file'];
    if (!is_file($filename)) {
        header("HTTP/1.0 404 Not Found");
        die();
    } else {
        readfile($filename);
    }
}
?>

How to Ask AI to Check Your Code for Exposure of Information Through Directory Listing

Exposure of Information Through Directory Listing Best Practices Checklist

• ✅ Restrict access to important directories and files.
• ✅ Turn off automatic directory listings in server configurations.
• ✅ Implement proper error handling to prevent exposing file structures.

Exposure of Information Through Directory Listing FAQ

How does Exposure of Information Through Directory Listing occur?

It occurs when a web server or application exposes directory listings, revealing file names and structures to unauthorized users.

What are the potential impacts of CWE-548 vulnerabilities?

Attackers can gain insights into system architecture, identify sensitive files, and exploit misconfigurations for further attacks.

How do you detect Exposure of Information Through Directory Listing in a web application?

Use manual testing methods like directory enumeration or automated scanners that check for directory listing features enabled on the server.

What are some best practices to prevent CWE-548 vulnerabilities?

Restrict access to sensitive directories, disable automatic directory listings, and implement proper authentication mechanisms.

Can you provide an example of vulnerable code related to CWE-548?

An application that does not properly handle requests for non-existent files may serve a directory listing instead.

How do you fix Exposure of Information Through Directory Listing in a web server configuration?

Disable directory listings and ensure proper error handling to prevent exposing file structures.

What are some common mistakes when mitigating CWE-548 vulnerabilities?

Relying solely on denylisting specific paths or patterns without robust validation can lead to bypasses.

Vulnerabilities Related to Exposure of Information Through Directory Listing

References

• MITRE: CWE-548
• OWASP Top 10 A01:2025 - Broken Access Control
• NVD NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Exposure of Information Through Directory Listing and other risks before an attacker does.