How an Attacker Reads Your .env Through a Misconfigured PHP-FPM

.env outside the document root isn’t enough. The PHP-FPM path-walking attack that turns uploaded JPEGs into .env reads, verified.

Photo by XT7 Core on Unsplash

A team gets a notification from their cloud provider: their AWS access keys are being used to spin up cryptocurrency miners in regions they don’t operate in. The keys were in their Laravel application’s .env file. The .env file was outside the web document root, in the application's parent directory — exactly where Laravel's setup guide says to put it. The application uses nginx with PHP-FPM, the standard Laravel deployment pattern. Nothing in the architecture should expose .env to the public internet. Yet somehow, the attacker read it.

The investigation traces the breach to two configuration issues that, individually, are mostly benign. The first is the nginx location block matching pattern: location ~ \.php { ... } without a $ anchor at the end. The second is PHP-FPM's cgi.fix_pathinfo=1 setting, the historical default that's still common in older configurations. Combined, they let an attacker upload a profile picture containing PHP code, then request a URL that causes PHP-FPM to execute that picture as PHP — gaining the ability to read any file the PHP process can access, including .env. The attack uses a single curl command. The misconfigurations have been in place since the team…