Nessus Scanner returns a "Medium" vulnerability

[gavargas22]

I am using Sentora to provide a server for multiple web applications and it was scanned by a Vulnerability Scanner called Nessus

This is what the scanner says:

At least one web application hosted on the remote web server discloses the physical path to its directories when a malformed request is sent to it.

I see that the path in question is /etc/styles/Sentora_Default/global-css/login.css

Is this really a problem? Can this be fixed? It seems that the path is not really the one pointing to the Sentora directory.

The scanner suggests that one should filter error messages containing path information. Does anyone have any comments regarding this?

Thank you

[5050]

At my opinion it is not a vulnerability, but a false positive, for many reasons :

• the path targets a public file. Any browser can get it with the same path at http://panel.domain.tld/etc/styles/....
• the path is not the full system path, it is only the relative path from the panel domain root, like any other public file of the panel
• as the project is open source, anybody can know easily the full path of each file.

I think it is a false positive because the first directory of the "style" branch have been named "etc", like the "/etc" directory of linux, some legacy of old time... I would be happy to rename it (I hate such catchall name), but it may break some third party modules, so such change must be handled with a lot of care.

[gavargas22]

I think you are exactly right! Thank you for the quick reply!