1113207 - Sensitive Files Exposed via Directory Listing

Status: RESOLVED WORKSFORME

(Socorro :: General, task)

Description

[Shubham mittal]

Attachment: dr1.PNG

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Steps to reproduce:

Browse to https://crash-stats-prod.zlb.phx.mozilla.net/.


Actual results:

This shows a complete directory listing of crash reports, .sh files, internal test files, etc. 




Expected results:

I am not sure if this is intentionally made public or not. In case this was intentionaly public, obviously not a bug. Otherwise should be patched on immediate basis, as information being disclosed sounds a bit critical. 

Thank you.

Comment 1

[Shubham mittal]

Attachment: dr2.PNG

Comment 2

[Shubham mittal]

Attachment: dr3.PNG

Comment 3

[Kohei Yoshino [:kohei]]

Crash stats are publicly available here; I guess nothing is sensitive.
https://crash-stats.mozilla.com/home/products/Firefox

Comment 4

[Robert Kaiser]

This is exposing only public data (and some scripts to run reports on that public data as well as the resulting reports), and its normal URL is actually https://crash-analysis.mozilla.com/

Comment 5

[Shubham mittal]

Okay. Great then.:)

Comment 6

[Andre Klapper]

So can this be closed as INVALID? Or what needs to be done here?

Comment 7

[Robert Kaiser]

Closing as WFM as I don't see anything sensitive.