Slashdot Mirror
400,000 Websites Vulnerable Through Exposed .git Directories (scmagazine.com)
Open .git directories are a bigger cybersecurity problem than many might imagine, at least according to a Czech security researcher who discovered almost 400,000 web pages with an open .git directory possibly exposing a wide variety of data. From a report: Vladimir Smitka began his .git directory odyssey in July when he began looking at Czech websites to find how many were improperly configured and allow access to their .git folders within the file versions repository. Open .git directories are a particularly dangerous issue, he said, because they can contain a great deal of sensitive information. "Information about the website's structure, and sometimes you can get very sensitive data such as database passwords, API keys, development IDE settings, and so on. However, this data shouldn't be stored in the repository, but in previous scans of various security issues, I have found many developers that do not follow these best practices," Smitka wrote. Smitka queried 230 million websites to discover the 390,000 allowing access to their .git directories. The vast majority of the websites with open directories had a .com TLD with .net, .de, .org and uk comprising most of the others.
^/.*/\.git/
Protect git repositories in all subdirectories as well.
just an article from 2015 https://en.internetwache.org/d...
I can give you also next year's article about .file vulnerabilities. (spoiler alert) https://en.internetwache.org/s...
Thats what you get on hiring those bootcamp "graduates"
Kode w/ Karlie Kloss, like it or not.
And it probably is. The thing is, the website owners are using git to version control and deploy their website (not a bad idea). So they develop their web site, push it to the central git repo, and whenever they need to go live, they just do a "git pull" on the webserver and it'll pull down the latest version of the website.
Problem is, they forget about the hidden .git directory git makes that stores all sorts of useful information and with a little persistence, allow you access to the raw source code since you can access the individual git objects. (Or maybe even clone it using git).
Slashdot is still using CVS try https://slashdot.org/CVS/
you will see, it works! :)
Everything I write is lies, read between the lines.
230 million websites. 400k poorly configured. 4*10^5/2.3*10^8 is less than 0.2% of websites surveyed screwed this up.
400k is a big number but it's good to know most developers aren't that stupid on this issue.
An open git directory will be everything you need to reconstruct the site, more often than not from the same server you're targeting. Scary. Database servers are rarely open. Short of some serious hacking, there isn't a lot you're going to be able to do with this stuff once you've obtained the information you're waving around here.
Until such time as I see hackers actually logging in with this information and defacing github, I'm going to remain unconvinced of the severity of this one.
This signature has Super Cow Powers
... Equifax types for free security tests from 3rd parties and press coverage, presumably...
Why stop there? Are there any dot files/directories that need to be served over HTTP?
I do this, it is very convenient for deploying updates to the site. But I always put the web interface into a subdirectory, and only configure the web server to see that so the .git directory is not visible over HTTP. And dotfiles and directories are blocked in the webserver config for extra protection against accidental inclusion of invisible files.
Why doesn't Apache block all '.'-prefixed directories by default?