Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by izkaizz - 03.11.2026
Last edited by cbay - 05.11.2026

## Summary
The Flyspray tracker at https://security.alwaysdata.com/ still serves its
.git directory to unauthenticated visitors. This is a regression / incomplete
fix of  FS#532  ("Exposed .git repository", Closed 23.10.2026, previously rated
High by your team). Eleven days after that task was closed, the same exposure
was still live on 2026-11-03, and re-verified live on 2026-11-04.

## Affected host
https://security.alwaysdata.com/ (the official bug-bounty report tracker)

## Severity suggestion
Low to Medium, at triage's discretion. We deliberately do NOT claim High on
the evidence below alone. High would only apply if your server-side check
confirms that .git objects / source files are also served, which we did not
test (see Honest caveats).
- CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor),

also related CWE-538 (Insertion of Sensitive Information into an
Externally-Accessible File or Directory).

- CVSS 3.1 for the verified metadata disclosure alone:

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3

## Impact (verified)
An unauthenticated visitor can read deployment metadata of the tracker that
should not be public: the deployed branch (master), the upstream remote
(github.com/flyspray/flyspray.git), and the exact deployed commit hash.
Measured impact: 3 metadata files confirmed served unauthenticated,
2 negative controls returned 404, 0 bytes of source downloaded,
0 other users' data touched.

## Reproduction steps (numbered, no authentication needed)
1. Run: curl -s https://security.alwaysdata.com/.git/HEAD

 Expected: HTTP 200, body "ref: refs/heads/master" (23 bytes).

2. Run: curl -s https://security.alwaysdata.com/.git/config

 Expected: HTTP 200, a valid git config naming remote origin
 https://github.com/flyspray/flyspray.git and branch master.

3. Run: curl -s https://security.alwaysdata.com/.git/refs/heads/master

 Expected: HTTP 200, body "a1ffafd65d5662d69e8b0334315b857449e3ea38" (41 bytes).

4. Negative control: curl -s -o /dev/null -w "%{http_code}\n" https://security.alwaysdata.com/.git/DEFINITELY_NOT_EXIST_12345

 Expected: HTTP 404. This rules out a generic 200 handler: the .git files
 above are genuinely served.

## PoC (complete, copy-paste runnable, no auth, no retry)
```
curl -s https://security.alwaysdata.com/.git/HEAD curl -s https://security.alwaysdata.com/.git/refs/heads/master curl -s -o /dev/null -w "%{http_code}\n" https://security.alwaysdata.com/.git/DEFINITELY_NOT_EXIST_12345 ```

## Evidence timeline
- First observed: 2026-11-03 ~22:40-22:42 WIB (15:40-15:42 UTC), single

attempts, retry OFF.

- Re-verified live before submission: 2026-11-04 ~01:14 WIB

(2026-11-03 18:14 UTC): HEAD 200 (23 bytes, same content), config 200,
refs/heads/master 200 (41 bytes, same commit hash), control path 404.

## Why this is not by design
 FS#532  itself proves your team treats an exposed .git on this tracker as a
flaw to be fixed, not intended behaviour. Your tracker also has precedent
for accepting incomplete-fix / regression reports as separate tasks
(e.g.  FS#533  as an incomplete fix of  FS#481 ,  FS#527  as a regression of
 FS#305 /504/520). This report follows that same pattern: Closed 23.10, still
live 03.11, therefore the fix was not effective.

## Honest caveats (please read before triage)
1. Duplicate risk, stated openly: you may close this as a duplicate or

 informative follow-up of FS#532. Our differentiator is only that FS#532
 is Closed while the exposure is still live, i.e. an ineffective fix /
 regression, not a new first report of the same issue.

2. .git objects / full source NOT tested: we deliberately stopped at

 metadata (HEAD, config, refs). We did not enumerate or download objects,
 logs, or source, in line with your rule against over-exploitation and
 accessing internal data further than needed. If objects are also served,
 the impact is larger (full tracker source plus local modifications), but
 that is UNTESTED and we do not claim it. You can verify server-side.

3. Testing method: manual curl at low rate only. No automated scanner, no

 DoS, no brute force, no access to any other user's account, task, or
 attachment.

## Suggested fix
Block public access to the .git directory on the tracker virtual host
(e.g. deny all requests under /.git/), and verify the deployed fix from an
unauthenticated request, since the previous fix for  FS#532  did not hold.

## Reporter
Name: Izka. Contact email: izkalavender@gmail.com. Payout details: to be provided upon acceptance.
Note: we understand reports on this tracker become public after processing,
and we accept that for this submission.