g-fox.cn存在 .DS_Store文件导致信息泄露
Categories
(Mozilla China :: General, defect)
Tracking
(Not tracked)
People
(Reporter: zhoucheng, Assigned: hyang)
Details
(Keywords: reporter-external)
Attachments
(1 file)
204.19 KB,
application/x-zip-compressed
|
Details |
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
Steps to reproduce:
我发现在g-fox.cn中存在.DS_Store文件。
http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store
Actual results:
使用ds_store_exp.py解析.DS_Store文件并递归下载文件。
C:\Users\admin\Desktop\ds_store_exp-master>python2 ds_store_exp.py http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store
[200] http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store
[200] http://g-fox.cn/chinaedition/addons/cpmanager/update.rdf
[!] [Errno 2] No such file or directory: u'g-fox.cn/chinaedition/addons/cpmanager/update.rdf/.DS_Store'
[200] http://g-fox.cn/chinaedition/addons/cpmanager/cpmanager-1.2.12.xpi
Expected results:
删除 .DS_Store文件
Updated•5 years ago
|
Comment 1•5 years ago
|
||
.DS_Store文件已删除。
Comment 2•5 years ago
|
||
reporter requested a bounty in mail to the security alias. I don't believe the Mozilla China sites are covered (g-fox.cn doesn't appear on the "eligible" list) but flagging for review just in case.
Comment 3•5 years ago
|
||
The bounty committee determined that this does not meet the criteria for a bug bounty.
Updated•5 years ago
|
Updated•8 months ago
|
Description
•