CWE-219 (Web根目录下的敏感数据) — Vulnerability Class 5

CWE-219 represents a critical configuration weakness where sensitive data, such as credentials or private keys, is inadvertently stored within the web server’s document root directory. This vulnerability typically arises when developers place non-public files in accessible directories without implementing strict access controls or proper server configuration. Attackers exploit this oversight by directly requesting the file’s URL through a web browser or automated tool, bypassing application-level security checks to retrieve confidential information. To prevent this, developers must segregate sensitive data from publicly accessible web content, storing such files outside the document root entirely. Additionally, configuring web servers to deny direct access to specific file types or directories, and employing robust access control mechanisms, ensures that only authorized application logic can interact with protected resources, thereby mitigating the risk of unauthorized disclosure.