--- title: "TYPO3-PSA-2018-002: Web Resource Restrictions" url: "https://news.typo3.com/security/advisory/typo3-psa-2018-002" description: It has been discovered that development related information can be retrieved by regular HTTP GET requests on NGINX web server environments missing strict access restriction settings. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - Public Service Announcement --- # TYPO3-PSA-2018-002: Web Resource Restrictions - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2018-002: Web Resource Restrictions ============================================= 20 November 2018 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that development related information can be retrieved by regular HTTP GET requests on NGINX web server environments missing strict access restriction settings. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - Release Date: November 20, 2018 - Component Type: Web server hosting environment - Impact: Information disclosure of developer related resources - Type: Advisory ### Problem Description The TYPO3 security team has been informed about the possibility to retrieve development related information - such as Composer or TypoScript configurations - by regular HTTP GET requests on NGINX web server environments missing strict access restriction settings. The TYPO3 core already provides default configuration for Apache web server and Microsoft Internet Information Server (IIS) using custom override techniques (.htaccess and web.config declarations). Since this functionality is not available on web servers running NGINX, server maintainers have to ensure internal resources are restricted from being exposed to the public web interface. This  information could be used by attackers in order to infer internal system behavior as well as to identify specific release versions (TYPO3 core, extensions, packages). ### Solution The TYPO3 security guide has been extended and addresses the topic in greater detail. Primarily, hosting environments using NGINX should be adjusted and reviewed in order to not expose internal information anymore. Apache and IIS environments were already provided with default values delivered by the TYPO3 core, but should be reviewed once more whether their restriction settings are up-to-date. A section showing potential URLs that should be restricted has been added to the security guide accordingly. ### Links - [Security Guide - Restrict access to files on a server-level](https://docs.typo3.org/typo3cms/CoreApiReference/Security/GuidelinesAdministrators/Index.html#restrict-access-to-files-on-a-server-level) - [Security Guide - Configuration example for NGINX web servers](https://docs.typo3.org/typo3cms/CoreApiReference/Security/GuidelinesAdministrators/Index.html#nginx-web-servers) ### Credits Credits go to Peter Schuler & Thomas Löffler who reported the vulnerability. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)