1370017 - Directory Listing

Status: RESOLVED DUPLICATE of bug 1340905

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Tanmay]

Attachment: Mozila.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
Build ID: 20170518000419

Steps to reproduce:

Vulenrability Name : Directory Listing  

Vulenrability Description : 
The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may conatin files that are not normally exposed through links on the web site .

Vulenrable URL : https://hg.mozilla.org/users/

POC : screenshot enclosed in attachement 


Actual results:

Vulenrability Name : Directory Listing  

Vulenrability Description : 
The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may conatin files that are not normally exposed through links on the web site .

Vulenrable URL : https://hg.mozilla.org/users/

POC : screenshot enclosed in attachement 


Expected results:

Vulenrability Name : Directory Listing  

Vulenrability Description : 
The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may conatin files that are not normally exposed through links on the web site .

Vulenrable URL : https://hg.mozilla.org/users/

POC : screenshot enclosed in attachement

Comment 1

[Andre Klapper]

> The web server is configured to display the list of files contained in this directory. This is not recommended
> because the directory may conatin files that are not normally exposed through links on the web site

This does not make sense because the directories contain free and open source code which is intentionally meant to be public. This is called source code hosting.