Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by belugaw33 - 29.08.2026
Last edited by cbay - 31.08.2026

EXPOSED .GIT DIRECTORY AT SECURITY.ALWAYSDATA.COM (REGRESSION OF  FS#428 )

Target: https://security.alwaysdata.com/.git/ Class: Information Exposure (Sensitive File / Source Code Metadata Disclosure)
Finding type: Regression (previously fixed vulnerability re-introduced)

---

SUMMARY

The .git directory on security.alwaysdata.com is publicly accessible. Core Git files (config, HEAD, index, packed-refs, refs/heads/master) return HTTP 200 with no authentication. The same issue was reported as  FS#428  and closed as Fixed on 01.08.2026 by cbay. It is back 28 days later.

Exposed: repository metadata, the full deployment file tree (942 index entries), branch names, and commit hashes. The object store (objects/) returns 404, so the source code itself cannot be fully downloaded.

---

VULNERABILITY DETAILS

Exposed files (HTTP 200):

/.git/config  ->  Repository config, origin = github.com/flyspray/flyspray.git
/.git/HEAD  ->  ref: refs/heads/master
/.git/index  ->  Valid Git index file (DIRC magic), 942 entries, 102 KB
/.git/packed-refs  ->  40+ branches (including remote branches)
/.git/refs/heads/master  ->  Commit hash a1ffafd65d5662d69e8b0334315b857449e3ea38

Not exposed (HTTP 404):

/.git/objects/<hash>  ->  Object store not accessible
/.git/objects/info/packs  ->  404
/.git/info/refs  ->  404

---

STEPS TO REPRODUCE

1. Repository config is readable:
   curl -s https://security.alwaysdata.com/.git/config

2. HEAD returns the active branch:
   curl -s https://security.alwaysdata.com/.git/HEAD
   Output: ref: refs/heads/master

3. Index is a genuine git file (first 4 bytes = DIRC):
   curl -s https://security.alwaysdata.com/.git/index | head -c 4
   Output: DIRC

4. packed-refs leaks the branch list:
   curl -s https://security.alwaysdata.com/.git/packed-refs

5. HEAD commit hash:
   curl -s https://security.alwaysdata.com/.git/refs/heads/master

A full runnable PoC script is attached (poc_git_exposure.txt).

---

IMPACT

1. The deployment file tree is exposed. The Git index lists every file on the server (942 files). An attacker can map the app and knows exactly where to look for more bugs.

2. Repository metadata leaks. Branch names and commit hashes reveal the software version and internal development patterns.

3. The fix did not hold. FS#428 was closed as Fixed on 01.08.2026, but the same issue came back. Most likely the deployment was redone without removing the .git directory from the document root.

---

RECOMMENDED FIX

1. Block web access to the .git directory at the server level (Apache Directory directive or rewrite rule).
2. Remove the .git directory from the deployment document root. Repositories should live outside the folder served to the public.
3. Add a regression test to the deployment process so the .git directory cannot reappear later.
4. Review access logs to check whether the .git directory has ever been downloaded.

---