1509328 - Source code disclosure due to publicly available .git endpoint.

Status: RESOLVED DUPLICATE of bug 1479976

(Websites :: Other, defect)

Description

[neutrinoguy]

Attachment: Logs file from git repository

Hello Mozilla Security Team,

#Introduction

I have found a public available git endpoint on a Mozilla Subdomain, I am  sending all details below. Due to the issue on can easily fetch source code for the repository.

# Proof of concept

1) https://surveillance.mozilla.org/.git/logs/HEAD
2) https://surveillance.mozilla.org/.git/config
3) https://surveillance.mozilla.org/.git/HEAD

#Impact

Due to easy availability of source code one can, use it to find further issues and may use to understand internal workings.
This can be done with tools like "Gittools" on GitHub.

#Fix

Either add proper rules to .htaccess file or remove the git file completely. 

#Note

I have not tried to pull source code using the tool, let me know if you want me to do that. I have attached an image for POC of logs file.

Reference: https://hackerone.com/reports/218465
Tool to fetch Source code: https://github.com/internetwache/GitTools/tree/master/Dumper

Regards,
Aagam Shah

Comment 1

[Caglar Ulucenk [:cag]]

Hi :jgmize,

It looks like this is a private repo of yours. Can you please look into this?

If there are any secrets in the repo, I'd recommend them to be rotated.