---
title: "A6: Application Framework and CMS Configuration"
canonical: https://openvapt.com/academy/a6.html
html: https://openvapt.com/academy/a6.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A6: Application Framework and CMS Configuration

How Laravel, Symfony, Rails, Spring Boot, Flask, Drupal, Joomla, Magento, Ghost and WordPress each express the same five production mistakes, and how to find them from the files on disk.

- Level: Applied
- Time: about 35 minutes
- Read first: P13, P14

## You Will Be Able To

- Map a framework's configuration file and setting names to the five mistakes: debug on, secret exposed, wrong environment, lifecycle expired, writable code.
- Find application projects on a server from their configuration files without running them.
- Explain why on-disk checks and HTTP checks of the same weakness complement each other.

## Five Mistakes, Many Spellings

Frameworks differ in syntax and agree on failure modes. Debug mode is APP_DEBUG=true in Laravel (WEB-APP-001), APP_ENV=dev in Symfony (WEB-APP-003) and DEBUG = True in Django (WEB-PY-001). It is debug=True in a Flask entry file (WEB-APP-007), MAGE_MODE developer in Magento (WEB-CMS-015) and WP_DEBUG in WordPress (WEB-CMS-006). In every case the error page prints configuration, queries or source to whoever triggers an error.

Secrets live in .env files, Rails master.key and secrets.yml, Django settings.py and Spring application.properties. The questions are the same. Is the file readable by every local account (WEB-APP-002, WEB-APP-004)? Is it inside a web root (WEB-DOC-001, WEB-APP-004)? Is a generated or empty key still in place (WEB-APP-001, WEB-PY-003)? Spring Boot adds its own leak: management.endpoints.web.exposure.include=* publishes env, configprops and heapdump over HTTP (WEB-APP-006).

## Environment and Transport

Production settings are a mode, not a default. Rails only marks cookies Secure and redirects to HTTPS when config.force_ssl is true (WEB-APP-005). Ghost builds every admin and member link from its configured url, so http:// there means credentials in the clear (WEB-CMS-016). Drupal trusts any Host header until trusted_host_patterns is set (WEB-CMS-013). Its update_free_access setting lets anyone run update.php (WEB-CMS-019).

## Lifecycle and Writable Code

A CMS past end of life gets no security advisories: Drupal 7, 8 and 9 (WEB-CMS-012) and Joomla 3 and 4 (WEB-CMS-014) are read from version files on disk. The same reasoning applies to dependencies: a composer.lock or package-lock.json untouched for a year means every library fix since then is missing (WEB-APP-008, informational).

Code the web server can be made to run must not be writable by other users. chmod -R 777 storage makes Laravel's bootstrap/cache and Symfony's var/cache, which hold compiled PHP, writable by every account (WEB-APP-010). A .git folder inside the document root (WEB-APP-009) is one server rule away from publishing the source; WEB-EXP-001 tests whether that has already happened. WordPress adds two small exposures: wp-cron.php reachable by visitors (WEB-CMS-017) and the /?author=1 redirect that reveals login names (WEB-CMS-018).

## Finding Projects Without Running Them

OpenVAPT looks for projects where administrators put them: /srv, /opt, /var/www, home folders and every configured web root, three folders deep. It recognises a framework by a marker setting (APP_KEY for Laravel, APP_SECRET for Symfony, config/master.key for Rails). Files under those folders are read without following symbolic links, because a site user could point .env at /etc/shadow. Only the path and the setting name reach the report; a value is never copied, and the report is redacted again before it is written.

## In Summary

Frameworks fail the same five ways under different names: debug on, a default or readable secret, development environment in production, transport not forced and writable code or stale dependencies. Find projects from files, read .env without following links, and check each setting in its own spelling.

## Apply It

- [WEB-APP-001 Laravel Debug Mode On or Application Key Missing](https://openvapt.com/checks/WEB-APP-001.md) (high)
- [WEB-APP-002 Application .env File Readable by All Users](https://openvapt.com/checks/WEB-APP-002.md) (medium)
- [WEB-APP-003 Symfony Running in the Development Environment](https://openvapt.com/checks/WEB-APP-003.md) (high)
- [WEB-APP-004 Rails Master Key or Secrets File Exposed](https://openvapt.com/checks/WEB-APP-004.md) (high)
- [WEB-APP-005 Rails Production Does Not Force HTTPS](https://openvapt.com/checks/WEB-APP-005.md) (medium)
- [WEB-APP-006 Spring Boot Actuator Endpoints Fully Exposed](https://openvapt.com/checks/WEB-APP-006.md) (high)
- [WEB-APP-007 Flask Debug Mode Enabled in Application Code](https://openvapt.com/checks/WEB-APP-007.md) (low)
- [WEB-APP-008 Dependency Lock Files Older Than a Year](https://openvapt.com/checks/WEB-APP-008.md) (info)
- [WEB-APP-009 Git Repository Stored Inside a Web Root](https://openvapt.com/checks/WEB-APP-009.md) (medium)
- [WEB-APP-010 Framework Writable Folders Open to All Users](https://openvapt.com/checks/WEB-APP-010.md) (medium)
- [WEB-CMS-012 Drupal Core Past End of Life](https://openvapt.com/checks/WEB-CMS-012.md) (high)
- [WEB-CMS-013 Drupal Trusted Host Patterns Not Set](https://openvapt.com/checks/WEB-CMS-013.md) (medium)
- [WEB-CMS-014 Joomla Core Past End of Life](https://openvapt.com/checks/WEB-CMS-014.md) (high)
- [WEB-CMS-015 Magento Not in Production Mode](https://openvapt.com/checks/WEB-CMS-015.md) (medium)
- [WEB-CMS-016 Ghost Configured With a Plain HTTP Site URL](https://openvapt.com/checks/WEB-CMS-016.md) (medium)
- [WEB-CMS-017 WordPress Cron Reachable by Visitors](https://openvapt.com/checks/WEB-CMS-017.md) (info)
- [WEB-CMS-018 WordPress Author Archive Reveals Login Names](https://openvapt.com/checks/WEB-CMS-018.md) (low)
- [WEB-CMS-019 Drupal update.php Open Without Authentication](https://openvapt.com/checks/WEB-CMS-019.md) (high)

## Lab

1. `Run: openvapt demo --only WEB-APP-,WEB-CMS- --out a6 and group the findings under the five mistakes.`
2. `Read the vulnerable and hardened Laravel, Symfony, Rails and Spring Boot files in internal/lab/fixtures_containers_apps.go and write the one-line fix for each.`
3. `Pick one framework you use and list its equivalent of each of the five mistakes, with the exact setting name; propose it as a new check (module A4).`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Which Spring Boot setting publishes environment variables over HTTP?
   - A. server.port=8080
   - B. management.endpoints.web.exposure.include=*
   - C. spring.profiles.active=prod
   - D. management.server.port=9090
   - Answer: B. exposure.include=* exposes env, configprops and heapdump unless security is added.

2. Why does OpenVAPT read .env files without following symbolic links?
   - A. Symbolic links are slower to read
   - B. A site user could replace .env with a link to a root-only file such as /etc/shadow
   - C. Frameworks forbid links
   - D. Symbolic links cannot point to files
   - Answer: B. Files under user-writable folders are untrusted; refusing links stops a confused-deputy read.

3. A composer.lock is 800 days old. What does that prove?
   - A. The application is vulnerable to a specific CVE
   - B. No dependency updates have been applied in that time, so every library fix since then is missing
   - C. Composer is not installed
   - D. The lock file is corrupt
   - Answer: B. It is a freshness signal; the known-vulnerability checks and composer audit name specific issues.

4. What does Rails config.force_ssl = true do beyond redirecting to HTTPS?
   - A. Nothing else
   - B. Marks cookies Secure and sends Strict-Transport-Security
   - C. Disables the asset pipeline
   - D. Encrypts the database
   - Answer: B. force_ssl also protects the session cookie and enables HSTS.

5. What does Drupal do until trusted_host_patterns is set?
   - A. Trusts any Host header
   - B. Refuses all requests
   - C. Requires HTTPS
   - D. Disables update.php
   - Answer: A. Without the patterns, a forged Host header can poison generated links (WEB-CMS-013).

## Key Terms

- Debug Mode: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.
- Environment File: A .env or similar file of KEY=value settings that an application reads at start, usually holding secrets and the debug and environment switches.
- Trusted Host: A setting that lists the host names an application accepts in the Host header, so attackers cannot make it build links to their own domain.
- Lock File: A file such as composer.lock or package-lock.json that pins the exact versions of every dependency an application installs.
- End of Life: The date after which a product no longer receives security fixes from its maintainer.
- Hardening: Reducing a system's attack surface and weaknesses through configuration.

## References

- [Laravel documentation, Deployment](https://laravel.com/docs/12.x/deployment)
- [Symfony documentation, How to Deploy a Symfony Application](https://symfony.com/doc/current/deployment.html)
- [Ruby on Rails Guides, Securing Rails Applications](https://guides.rubyonrails.org/security.html)
- [Spring Boot documentation, Actuator endpoints](https://docs.spring.io/spring-boot/reference/actuator/endpoints.html)
- [Drupal.org, Trusted Host settings](https://www.drupal.org/docs/getting-started/installing-drupal/trusted-host-settings)
- [OWASP ASVS 4.0.3, V14 Configuration](https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x22-V14-Config.md)
- [OWASP WSTG-CONF-02, Test Application Platform Configuration](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/02-Test_Application_Platform_Configuration/)

Offline: `openvapt learn A6`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a6.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.