|
Task Description
## Summary
The Flyspray tracker at https://security.alwaysdata.com/ still serves its
.git directory to unauthenticated visitors. This is a regression / incomplete
fix of FS#532 ("Exposed .git repository", Closed 23.10.2026, previously rated
High by your team). Eleven days after that task was closed, the same exposure
was still live on 2026-11-03, and re-verified live on 2026-11-04.
## Affected host
https://security.alwaysdata.com/ (the official bug-bounty report tracker)
## Severity suggestion
Low to Medium, at triage's discretion. We deliberately do NOT claim High on
the evidence below alone. High would only apply if your server-side check
confirms that .git objects / source files are also served, which we did not
test (see Honest caveats).
- CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor),
also related CWE-538 (Insertion of Sensitive Information into an
Externally-Accessible File or Directory).
- CVSS 3.1 for the verified metadata disclosure alone:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3
## Impact (verified)
An unauthenticated visitor can read deployment metadata of the tracker that
should not be public: the deployed branch (master), the upstream remote
(github.com/flyspray/flyspray.git), and the exact deployed commit hash.
Measured impact: 3 metadata files confirmed served unauthenticated,
2 negative controls returned 404, 0 bytes of source downloaded,
0 other users' data touched.
## Reproduction steps (numbered, no authentication needed)
1. Run: curl -s https://security.alwaysdata.com/.git/HEAD
Expected: HTTP 200, body "ref: refs/heads/master" (23 bytes).
2. Run: curl -s https://security.alwaysdata.com/.git/config
Expected: HTTP 200, a valid git config naming remote origin
https://github.com/flyspray/flyspray.git and branch master.
3. Run: curl -s https://security.alwaysdata.com/.git/refs/heads/master
Expected: HTTP 200, body "a1ffafd65d5662d69e8b0334315b857449e3ea38" (41 bytes).
4. Negative control: curl -s -o /dev/null -w "%{http_code}\n" https://security.alwaysdata.com/.git/DEFINITELY_NOT_EXIST_12345
Expected: HTTP 404. This rules out a generic 200 handler: the .git files
above are genuinely served.
## PoC (complete, copy-paste runnable, no auth, no retry)
```
curl -s https://security.alwaysdata.com/.git/HEAD curl -s https://security.alwaysdata.com/.git/refs/heads/master curl -s -o /dev/null -w "%{http_code}\n" https://security.alwaysdata.com/.git/DEFINITELY_NOT_EXIST_12345 ```
## Evidence timeline
- First observed: 2026-11-03 ~22:40-22:42 WIB (15:40-15:42 UTC), single
attempts, retry OFF.
- Re-verified live before submission: 2026-11-04 ~01:14 WIB
(2026-11-03 18:14 UTC): HEAD 200 (23 bytes, same content), config 200,
refs/heads/master 200 (41 bytes, same commit hash), control path 404.
## Why this is not by design
FS#532 itself proves your team treats an exposed .git on this tracker as a
flaw to be fixed, not intended behaviour. Your tracker also has precedent
for accepting incomplete-fix / regression reports as separate tasks
(e.g. FS#533 as an incomplete fix of FS#481 , FS#527 as a regression of
FS#305 /504/520). This report follows that same pattern: Closed 23.10, still
live 03.11, therefore the fix was not effective.
## Honest caveats (please read before triage)
1. Duplicate risk, stated openly: you may close this as a duplicate or
informative follow-up of FS#532. Our differentiator is only that FS#532
is Closed while the exposure is still live, i.e. an ineffective fix /
regression, not a new first report of the same issue.
2. .git objects / full source NOT tested: we deliberately stopped at
metadata (HEAD, config, refs). We did not enumerate or download objects,
logs, or source, in line with your rule against over-exploitation and
accessing internal data further than needed. If objects are also served,
the impact is larger (full tracker source plus local modifications), but
that is UNTESTED and we do not claim it. You can verify server-side.
3. Testing method: manual curl at low rate only. No automated scanner, no
DoS, no brute force, no access to any other user's account, task, or
attachment.
## Suggested fix
Block public access to the .git directory on the tracker virtual host
(e.g. deny all requests under /.git/), and verify the deployed fix from an
unauthenticated request, since the previous fix for FS#532 did not hold.
## Reporter
Name: Izka. Contact email: izkalavender@gmail.com. Payout details: to be provided upon acceptance.
Note: we understand reports on this tracker become public after processing,
and we accept that for this submission.
|
