Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Jan 21, 2024

17

OP

Level 8

Am I also vulnerable to this malware?

Hello,

Our security team sent me an email regarding a (relatively) new malware that allows attackers to access the .env file in Laravel and they told us to make sure there are no passwords in the .env right now, but we do have passwords there.

This is the source from which he gave it to us: https://www.darkreading.com/cloud-security/cisa-aws-microsoft-365-accounts-androxgh0st-attack

If my server is not Apache, but it is Windows Server, does it mean I am not vulnerable? Because from quick read I saw it's only targeting Apache servers.

*Edit: I was wrong, the title says: "Apache webservers and websites using the popular Laravel Web application framework", so looks like either of them separately

Also it says in the article:

"If the .env file is exposed, threat actors will issue a GET request to the /.env URI to attempt to access the data on the page," the two agencies said.

But how come? Isn't the .env naturally never exposed? it's behind the root of the server's folder

Also, in case I will need to remove passwords from the .env file.. is there any workaround until it is patched?

Or, I should just do a completely different approach for that and not store plain text passwords in the .env?

Thanks

Level 73

From the text in that post it seems that certain versions of Apache is affected by this. Are you telling me that you are hosting on a IIS server? That is not the prefect setup in my book. I would use a LEMP stack for the hosting, however, as long as they can't access the .env file, which is usually exposed due to the wrong document root, you should be good.

And yes, any system is always at risk to get infected by malware, Windows in particular, since it's the most used OS for regular ppl.

1 like

OP

Level 8

@Tray2 thank you.

Yes they work with Windows Servers mostly so they setup a Windows Server with IIS for us. Assuming they do not want to take the risk and make us remove the passwords from the .env - what options do I have?

I may have done it wrong that I did not encrypt the .env in production because it's not a server that's facing the outside world but now they are stricter and they don't care.

Will encrypting the .env do any better? Also, do I have any other option if I'm told I must remove the passwords from the .env (even if encrypted)? The passwords are changing daily so I need a way to read the new passwords from a secure location though I'm not sure where.

I know Windows has Credential Manager - is it possible to store passwords there, and read from there from Laravel? Or I should do something else?

Level 35

So navigate to yourdomain/.env and see if you can see your .env file in your browser or not

2 likes

OP

Level 8

@Ben Taylor Nope, can't.

By the way, if I use the .env.encrypted. How can I use it then? It needs to be decrypted. but if I use the config() helpers to read from the .env, will it also decrypt it on the fly?

Level 8

@ligonsker check this url for env encryption if you are using laravel 9 https://blog.laravel.com/laravel-new-environment-encryption-commands And you can update your .htaccess file to disable sensitive files/folders

1 like

OP

Level 8

@amitsolanki24_ thank you, yes I now plan to encrypt the .env file. But, if I'm using config() helpers around the code, will it automatically decrypt the .env file if the windows environment variable LARAVEL_ENV_ENCRYPTION_KEY is present?

I mean besides encrypting the .env and then storing the decryption key in the Windows ENV variables, is there anything else I need to do in order for Laravel to decrypt the .env whenever needed?

1 like

Level 8

@Ligonsker I haven't try this nut according yo me you don't have to do anything else

You can also check below links for more help.

https://stackoverflow.com/questions/62245142/is-it-possible-to-encrypt-the-information-in-env-file-in-laravel

https://blog.codewithdary.com/encrypt-and-decrypt-your-env-file-in-laravel

1 like

Level 122

this is such old news. A common vulnerability is caused by all those sites that put all their files in the served folder, eg public_html then try to hide the .env some custom way

We have known for years that this is bad practice, the only saving grace is that these are usually such low level targets they cause little noise.

The author's scaremonger style of writing is pointing out that high value credentials could be stolen

Typically those with high value credentials also know what they are doing and are not so stupid as to put plain text credentials in a public place.

As you say, if your file is outside of the served area of your site (usually the public folder) then there is no new vulnerability here.

If you are banned from passwords in .env because your security team don't understand the threat then you can move these to 'real' environment variables

The only reason to encrypt .env in my opinion is where you don't trust colleagues within your own organisation, eg support techs with access to the filesystem.

4 likes

OP

Level 8

@Snapey thank you! exactly my thoughts! Then I am safe. But also, there are 2 options from what I understand right now: Place in the "real" env, or, encrypt the .env and have a .env.encrypted file.

For the second option there's something I don't know yet - assuming my Laravel project reads from the .env file using the config() helper in several places. How does it know to decrypt it? because from what I saw it says to explicitly use decrypt. So I am not sure how to use the encrypted env file?

Level 122

@Ligonsker i offered you a third option

1 like

OP

Level 8

@Snapey To trust my colleagues? 😝

Level 122

If you are banned from passwords in .env because your security team don't understand the threat then you can move these to 'real' environment variables

You already indicated you know how to set environment variables such as LARAVEL_ENV_ENCRYPTION_KEY, so put your passwords in real Environment variables and remove them from your env file

The env helper you use in your config files knows to automatically merge environment variables with values from your env file

2 likes

OP

Level 8

@Snapey Oh yes this part I understand, but, if I did want to use the encrypted version of the .env instead of real environment variables, is it possible to use it? or the encrypted version is only for source control so that you can upload it there? And not for use with config() and so on?

Level 122

@Ligonsker just for safe storage, not use.

1 like

OP

Level 8

@Snapey Got it, thank you! And, placing them in the Windows Server environment variables - is that a good practice? like:

"DB_1_PASSWORD" with the plain text password value?

Well, it probably is good, because if someone has access to these variables it means he already got into the server 😅

Level 75

@Ligonsker main laravel including env should be out of web folder all together.

But many past discussions on this.

1 like

Level 122

relevant. https://securinglaravel.com/p/laravel-security-androxgh0st-malware

1 like

Please or to participate in this conversation.