|
Task Description
Asset: security.alwaysdata.com (alwaysdata security vulnerability tracker / Flyspray)
Severity: High - source code and configuration disclosure on the security reporting infrastructure
Summary
The Git metadata directory of the security vulnerability tracker application is publicly served at https://security.alwaysdata.com/.git/. This exposes the full source repository, internal configuration and commit history of alwaysdata's own security reporting infrastructure.
Steps to reproduce
$ curl -s https://security.alwaysdata.com/.git/HEAD HTTP 200 (23 bytes):
ref: refs/heads/master
$ curl -s https://security.alwaysdata.com/.git/config HTTP 200:
[core]
repositoryformatversion = 0
filemode = true
bare = false
logallrefupdates = true
[remote "origin"]
url = https://github.com/flyspray/flyspray.git
fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
remote = origin
merge = refs/heads/master
$ curl -s https://security.alwaysdata.com/.git/logs/HEAD HTTP 200:
0000000000000000000000000000000000000000 58bea729f4359a45f69aaba274bb2a931155b427 Cyril Bay cbay@alwaysdata.com 1704809861 +0100 clone: from https://github.com/flyspray/flyspray.git 58bea729f4359a45f69aaba274bb2a931155b427 a1ffafd65d5662d69e8b0334315b857449e3ea38 Cyril Bay cbay@alwaysdata.com 1783927681 +0200 pull: Fast-forward
Impact
- Full source code disclosure of the security tracker (a Flyspray instance) - the repository can be reconstructed from .git/objects/ (directory listing returns 403, but individual objects are served).
- Disclosure of internal configuration (.git/config) and commit history (.git/logs/HEAD), including the developer identity (Cyril Bay cbay@alwaysdata.com) and the latest deployed commit hash a1ffafd65d5662d69e8b0334315b857449e3ea38.
- An attacker can reconstruct the exact deployed source and audit it for further vulnerabilities. Because this host is where external security reports are collected and handled, a compromise here is highly sensitive.
Remediation
- Remove the .git directory from the web root, or
- Deny access to /.git in the web server configuration (e.g. nginx: location ~ /.git { deny all; }).
Note on verification
After the initial discovery, follow-up enumeration of .git/objects/ was rate-limited by the site firewall (HTTP 403, "Temporarily forbidden due to suspicious requests"). Requests were throttled afterwards in line with the program rules. The .git/HEAD, .git/config and .git/logs/HEAD responses above (HTTP 200 with valid Git content) are sufficient to confirm the exposure.
Reported by: Cahyo Dwi Saputro (bozsec) - boz@monsdigital.tech
|
