964099 - Root Access to internal sub domain

Status: RESOLVED INVALID

(Websites :: other.mozilla.org, defect)

Description

[test Us3r]

User Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36

Steps to reproduce:

Hi team,

I was running through your subdomains and was trying to find if you left any internal sub domain for public access which should not have been exposed. 

As expected I could reach one of your sub domain where in I found few of your developer files and also I had root access to the webpage.



Actual results:

As a result I could gain root access to https://bzr-zlb.vips.scl3.mozilla.com.
I have googled the above domain and realized that it is not publicly exposed and neither it should have been.

However I did not download any code or any files( FYR you can trace my ip if required)

This is a security bug I would like to report.


Expected results:

This sub domain should never be exposed to public.

It should rather give a 404 error or a message saying we are unauthorized to view.

Comment 1

[Reed Loden [:reed]]

This is just the vip for https://bzr.mozilla.org/. There's nothing sensitive here. It's all public.

Comment 2

[test Us3r]

Thanks for the confirmation.

Comment 4

[test Us3r]

Attachment: Test