MEDIUM
The severity is rated MEDIUM due to the potential for a local user to escalate privileges and access other users' data. This risk is heightened in homelab environments where security controls might be less stringent than in production systems.

Setting up a shared PHP host on a personal server, such as a Raspberry Pi, requires careful consideration to ensure security. The primary concern is that users might upload malicious code or exploit vulnerabilities in the web server configuration, potentially leading to unauthorized access and damage to other users' data. In scenarios where mod_userdir is enabled, there's a risk of 'escaping the user directory,' which could allow an attacker to modify files outside their designated area, affecting other accounts. Proper isolation mechanisms are necessary to prevent such cross-user compromises.

Affected Systems
  • Apache HTTP Server with mod_userdir enabled
  • PHP versions
Affected Versions: All versions of Apache HTTP Server and PHP
Remediation
  • Disable unnecessary features such as CGI execution within user directories by modifying the Apache configuration file (httpd.conf): `sed -i '/^\s*CGIExecutionPolicy/s/enabled/disabled/' /etc/httpd/conf.d/userdir.conf`.
  • Limit PHP execution to specific directories only and disable it in others. Modify php.ini: `cgi.fix_pathinfo=0` and ensure `open_basedir` is set appropriately, e.g., `/home/username/public_html:/tmp/:`
  • Use chroot jail for each user's directory if possible, or implement Linux namespaces to isolate processes.
  • Regularly update both Apache HTTP Server and PHP to their latest versions.
Stack Impact

In common homelab stacks using Raspberry Pi with Raspbian OS and Apache web server, the risk is significant as default configurations might not adequately secure shared hosting environments. Key files like /etc/apache2/mods-enabled/userdir.conf and php.ini need careful review to ensure they restrict PHP execution appropriately.

Source →