1479976 - Git repository found in "surveillance.mozilla.org"

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[aaish]

Git metadata directory (.git) was found in this folder. An attacker can extract sensitive information by requesting the hidden metadata directory that version control tool Git creates. The metadata directories are used for development purposes to keep track of development changes to a set of source code before it is committed back to a central repository (and vice-versa). When code is rolled to a live server from a repository, it is supposed to be done as an export rather than as a local working copy, and hence this problem.

Repository files/directories: surveillance.mozilla.org
├── [ 14K]  action
│   └── [9.6K]  index.html
├── [2.7K]  apple-touch-icon-precomposed.png
├── [9.5K]  close-window
│   └── [5.5K]  index.html
├── [ 23K]  css
│   └── [ 19K]  styles.min.css
├── [ 161]  Dockerfile
├── [1.1M]  fonts
│   ├── [997K]  open-sans
│   │   ├── [220K]  bold.eot
│   │   ├── [219K]  bold.ttf
│   │   ├── [ 60K]  bold.woff2
│   │   ├── [ 11K]  LICENSE.txt
│   │   ├── [212K]  regular.eot
│   │   ├── [212K]  regular.ttf
│   │   └── [ 59K]  regular.woff2
│   └── [169K]  sanchez
│       ├── [4.4K]  OFL.txt
│       ├── [ 71K]  regular.eot
│       ├── [ 71K]  regular.ttf
│       └── [ 19K]  regular.woff2
├── [ 79K]  img
│   ├── [ 55K]  content
│   │   ├── [ 25K]  facebook-panel-2.png
│   │   └── [ 26K]  facebook-panel.png
│   ├── [8.8K]  icons
│   │   ├── [ 216]  arrow-left.svg
│   │   ├── [ 213]  arrow.svg
│   │   ├── [ 211]  close.svg
│   │   ├── [ 275]  facebook.svg
│   │   ├── [ 975]  google-plus.svg
│   │   ├── [ 554]  instagram.svg
│   │   ├── [1.8K]  mozilla.svg
│   │   └── [ 596]  twitter.svg
│   └── [ 11K]  touch
│       ├── [2.2K]  chrome-touch-icon-196x196.png
│       ├── [ 707]  favicon.png
│       ├── [1.9K]  icon-128x128.png
│       └── [2.0K]  ms-touch-icon-144x144-precomposed.png
├── [7.8K]  index.html
├── [144K]  js
│   ├── [2.5K]  scripts.js
│   └── [138K]  vendor
│       ├── [125K]  bower-scripts.min.js
│       └── [8.5K]  modernizr.min.js
├── [ 16K]  LICENSE
├── [ 612]  nginx.conf
└── [1.1K]  README.md

 1.4M used in 12 directories, 37 files


These files may expose sensitive information that may help an malicious user to prepare more advanced attacks.

GET /.git/config HTTP/1.1
Host: surveillance.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: close
Upgrade-Insecure-Requests: 1

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "brigade"]
	url = [e-mail]:thebrigade/mozilla-surveillance.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[remote "deis"]
	url = ssh://[e-mail]:2222/surveillance.git
	fetch = +refs/heads/*:refs/remotes/deis/*
[remote "origin"]
	url = [e-mail]:mozilla/surveillance.mozilla.org.git
	fetch = +refs/heads/*:refs/remotes/mozilla/*
[remote "mozilla"]
	url = [e-mail]:mozilla/surveillance.mozilla.org.git
	fetch = +refs/heads/*:refs/remotes/mozilla/*
[remote "mozmar"]
	url = [e-mail]:mozilla/surveillance.mozilla.org.git
	fetch = +refs/heads/*:refs/remotes/mozilla/*
[branch "master"]
	pushRemote = origin

--------------
A tool such as GitHack.py can be used to obtain the site contents (https://github.com/lijiejie/GitHack)
python2.7 GitHack.py https://surveillance.mozilla.org/.git

Comment 1

[Simon Bennetts [:psiinon]]

The git repo for this site is actually public: https://github.com/mozilla/surveillance.mozilla.org
But even so we shouldnt be serving it up from https://surveillance.mozilla.org/

Comment 2

[Simon Bennetts [:psiinon]]

Raised an an issue on the repo: https://github.com/mozilla/surveillance.mozilla.org/issues/9

Comment 3

[aaish]

means its a duplicate ? :|

Comment 4

[Simon Bennetts [:psiinon]]

No, bug 1441701 is a tracker bug which links all instances of public git repos being exposed via websites.
This issue is still open its just not considered a security issue.

Comment 5

[aaish]

can i have an update on this.. thanks

Comment 7

[Josh Mize [:jgmize]]

I've deleted the git repo data from the s3 bucket backing this site. As :psiinon noted in comment #1 this was public on github already and not a security issue.