we have a website hosted on a server with nginx webserver.
Now , we have a file called web.config in /var/www/html/
So, when we gave security audit for the servers, they have recommended like:
web.config
File Information Disclosure
Ensure proper restrictions are in place, or remove the web.config file if the file is not required. Nessus was able to exploit the issue using the following request :
GET /web.config HTTP/1.1
So, even If I have change permission to read only also, I am able to download the data from browser.
What can be done here, Should we delete the file or can i get any alternative to make the file restricted so the file can exist with restrictions.