Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by bozsec - 23.10.2026
Last edited by cbay - 23.10.2026

Asset: security.alwaysdata.com (alwaysdata security vulnerability tracker / Flyspray)

Severity: High - source code and configuration disclosure on the security reporting infrastructure

Summary

The Git metadata directory of the security vulnerability tracker application is publicly served at https://security.alwaysdata.com/.git/. This exposes the full source repository, internal configuration and commit history of alwaysdata's own security reporting infrastructure.

Steps to reproduce

$ curl -s https://security.alwaysdata.com/.git/HEAD HTTP 200 (23 bytes):
ref: refs/heads/master

$ curl -s https://security.alwaysdata.com/.git/config HTTP 200:
[core]

      repositoryformatversion = 0
      filemode = true
      bare = false
      logallrefupdates = true

[remote "origin"]

      url = https://github.com/flyspray/flyspray.git
      fetch = +refs/heads/*:refs/remotes/origin/*

[branch "master"]

      remote = origin
      merge = refs/heads/master

$ curl -s https://security.alwaysdata.com/.git/logs/HEAD HTTP 200:
0000000000000000000000000000000000000000 58bea729f4359a45f69aaba274bb2a931155b427 Cyril Bay cbay@alwaysdata.com 1704809861 +0100 clone: from https://github.com/flyspray/flyspray.git 58bea729f4359a45f69aaba274bb2a931155b427 a1ffafd65d5662d69e8b0334315b857449e3ea38 Cyril Bay cbay@alwaysdata.com 1783927681 +0200 pull: Fast-forward

Impact

- Full source code disclosure of the security tracker (a Flyspray instance) - the repository can be reconstructed from .git/objects/ (directory listing returns 403, but individual objects are served).
- Disclosure of internal configuration (.git/config) and commit history (.git/logs/HEAD), including the developer identity (Cyril Bay cbay@alwaysdata.com) and the latest deployed commit hash a1ffafd65d5662d69e8b0334315b857449e3ea38.
- An attacker can reconstruct the exact deployed source and audit it for further vulnerabilities. Because this host is where external security reports are collected and handled, a compromise here is highly sensitive.

Remediation

- Remove the .git directory from the web root, or
- Deny access to /.git in the web server configuration (e.g. nginx: location ~ /.git { deny all; }).

Note on verification

After the initial discovery, follow-up enumeration of .git/objects/ was rate-limited by the site firewall (HTTP 403, "Temporarily forbidden due to suspicious requests"). Requests were throttled afterwards in line with the program rules. The .git/HEAD, .git/config and .git/logs/HEAD responses above (HTTP 200 with valid Git content) are sufficient to confirm the exposure.

Reported by: Cahyo Dwi Saputro (bozsec) - boz@monsdigital.tech