Vercel project has directory listing disabled
Vercel projects are assessed for directory listing configuration. When enabled, this feature allows visitors to browse the file structure of a deployment when no index file is present in a directory, potentially exposing source files, configuration files, and other assets that should not be publicly accessible.
ProwlerRisk
Enabled directory listing allows attackers to enumerate the file structure of the deployment, potentially discovering backup files, configuration files, source maps, or other sensitive assets. This information disclosure can be leveraged to identify attack vectors or access files that were not intended to be public.
Run this check with Prowler
Run in Prowler Cloudprowler vercel --checks project_directory_listing_disabledRecommendation
Disable directory listing to prevent visitors from browsing the file structure of your deployments. Ensure that all directories either contain an index file or return a 404 response when accessed directly.
Remediation
Other
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client
class project_directory_listing_disabled(Check):
"""Check if directory listing is disabled for the project.
This class verifies whether each Vercel project has directory listing
disabled to prevent exposure of the project's file structure.
"""
def execute(self) -> List[CheckReportVercel]:
"""Execute the Vercel Project Directory Listing check.
Iterates over all projects and checks if directory listing is disabled.
Returns:
List[CheckReportVercel]: A list of reports for each project.
"""
findings = []
for project in project_client.projects.values():
report = CheckReportVercel(metadata=self.metadata(), resource=project)
if not project.directory_listing:
report.status = "PASS"
report.status_extended = (
f"Project {project.name} has directory listing disabled."
)
else:
report.status = "FAIL"
report.status_extended = (
f"Project {project.name} has directory listing enabled, "
f"which may expose the project's file structure to visitors."
)
findings.append(report)
return findings