400,000 websites vulnerable through exposed .git directories

guest · Sep 6, 2018

400,000 websites vulnerable through exposed .git directories
September 05, 2018
https://www.scmagazine.com/400000-w...rough-exposed-git-directories/article/793787/

Open .git directories are a bigger cybersecurity problem than many might imagine, at least according to a Czech security researcher who discovered almost 400,000 web pages with an open .git directory possibly exposing a wide variety of data.

“Information about the website's structure, and sometimes you can get very sensitive data such as database passwords, API keys, development IDE settings, and so on. However, this data shouldn't be stored in the repository, but in previous scans of various security issues, I have found many developers that do not follow these best practices,” Smitka wrote.

[...] he recommends using <web-site>/.git/HEAD to ensure the folder is secure.
Click to expand...

guest · Apr 28, 2020

GDPR Compliance Site Leaks Git Data, Passwords
April 27, 2020
https://threatpost.com/data-leak-gdpr-advice-site/155199/

A website that gives advice on privacy regulation compliance has fixed a security issue that was exposing MySQL database settings — including passwords — to anyone on the internet.

The website, GDPR.EU, is an advice site for organizations that are struggling to comply with the General Data Protection Regulation (GDPR) laws that were imposed by the EU in 2018.
The issue was “easily found, quickly fixed, so a result all round,” said Vangelis Stykas and Joe Durbin, researchers with Pen Test Partners, in a Monday post.

“However, the irony of a EU-funded web site about GDPR having security issues isn’t lost on us.”
Stykas and Durbin said the issue stemmed from the website’s .git folder being readable by anyone online. This is a known problem due to lack of proper configuration – and one that’s been around for years.
Click to expand...

Open .git directories are a common problem – a scan of more than 230 million web domains worldwide in 2018, in fact, uncovered 390,000 web pages that were vulnerable due to the issue.
Click to expand...

Pen Test Partners: GDPR.EU has er… a data leakage issue

The web site GDPR.EU is an advice site ‘operated by Proton Technologies AG, co-funded by … the EU Horizon Framework’. It’s full of useful advice for organisations that need to comply with GDPR.
So imagine our surprise when we noticed a data leakage vulnerability in it!

It’s trivial then to clone the .git repository, as the files are effectively world-readable on the public internet. Google occasionally indexes /.git/ too.
Clearly a WordPress based web site. ‘wp-config’ looks very interesting: [...] So that’s the MySQL database password exposed. Oops!
Click to expand...

guest · Jun 26, 2020

Source Code Disclosure via Exposed .git Folder
June 25, 2020
https://medium.com/dev-genius/source-code-disclosure-via-exposed-git-folder-24993c7561f1

Today i am going to write about source code disclosure through exposed .git folder in a website/work environment.

This will also be important for programmers/web developers as to know and secure their source code(s) in their development environment. So, without any delay, let’s get straight to it. Now, the first question arises, why you should care or learn about open git folders in your website/working environment? Because:
• Anyone can use your source code for malicious intents, causing you financial/reputational damages
• Finding files containing sensitive information like credentials, tokens, new endpoints, etc [...]
Click to expand...

guest · Oct 19, 2020

New Gitjacker tool lets you find .git folders exposed online
Tool can also download your Git repositories, allowing attackers to retrieve sensitive configuration files and source code
October 19, 2020
https://www.zdnet.com/article/new-gitjacker-tool-lets-you-find-git-folders-exposed-online/

A new tool called Gitjacker can help developers discover when they've accidentally uploaded /.git folders online and have left sensitive information exposed to attackers.

Gitjacker was created by British software engineer Liam Galvin, is written in Go, and was released as a free download last month on GitHub.
In its simplest form, the tool lets users scan a domain and identify the location of a /.git folder on their production systems.
Click to expand...

/.git folders should never be uploaded online.

"A .git directory stores all of your [Git] repository data, such as configuration, commit history, and actual content of each file in the repository," Galvin said in a blog post last month when he launched Gitjacker.
All developers know this; however, accidents happen.
Click to expand...

However, this is where Gitjacker comes in. Galvin said he developed Gitjacker to handle the download and extraction of a git repository for users, even in cases where web directory listings are disabled.

Galvin said he developed the tool to be used in penetration tests, but due to its capabilities, Gitjacker will most likely be abused by threat actors as well (as threat actors have a long history of abusing open source tools for their operations).
In addition, there's an incentive for attackers to look for /.git folders. Even after years of warnings [1, 2, 3, 4], /.git exposure is still in high numbers, meaning attackers will have an easy time finding domains with /.git folders left exposed online.
Click to expand...

gitjacker
https://github.com/liamg/gitjacker

Gitjacker downloads git repositories and extracts their contents from sites where the .git directory has been mistakenly uploaded. It will still manage to recover a significant portion of a repository even where directory listings are disabled.

For educational/penetration testing use only.
More information at liam-galvin.co.uk/security/2020/09/26/leaking-git-repos-from-misconfigured-sites.html
Click to expand...

guest · Aug 18, 2022

Numerous sites at risk of exposure due to Git vulnerability
August 18, 2022

Threat actors could potentially compromise hundreds of thousands of websites due to a vulnerability within the Git open source development tool, TechRadar reports.

Defense.com noted that 332,000 websites, including 2,500 using the .gov domain, are at risk of potential data loss stemming from the flaw, which could be exploited to discover and download .git folders that contain websites' codebase histories, comments, security keys, previous code changes, sensitive remote paths, and plain-text passwords.
Click to expand...

Attackers could also gain access to API keys and database credentials, as well as determine other potentially exploitable bugs, according to researchers.

Security vulnerabilities are prevalent in open source technology as a result of its publicly accessible code and should prompt organizations to apply immediate remediation efforts, said Defense.com CEO Oliver Pinson-Roxburgh.

"Whilst it is true that some folders would have been purposefully left accessible, the vast majority will be unaware of the threat they are facing," Pinson-Roxburgh added.
Click to expand...

TechRadar: Open source bug leaves hundreds of thousands of sites open to attack

Git users exposing sensitive data through hidden folders
Click to expand...

guest · Jan 25, 2023

French rugby club Stade Français leaks source code
By Pierluigi Paganini - January 25, 2023

Stade Français is a professional rugby union club based in Paris. Founded in 1883 and competing in France’s premier rugby league, Top 14, it has established itself as one of the most successful teams in the country, with a dedicated fan base of hundreds of thousands of followers on social media.
Click to expand...

Cybernews recently discovered that the server hosting the official Stade Français website was leaking its source code through the publicly accessible .git directory. The website provides fans with daily news updates, upcoming matches, match reviews, ticketing services, and a merchandise shop.

Poor access control to .git directories potentially enabled threat actors to make unauthorized changes to the club’s server. If the threat actors had exploited the vulnerability, it might have posed risks to the users’ data and could have potentially resulted in the takeover of the server.
Git is a popular tool that enables tracking code changes and helps programmers to collaborate. The .git directory is the place where the metadata and object database of the projects are stored.
Click to expand...

Serious security risks
Unsecured access to the website’s .git directory potentially allowed anyone to partially or fully download the application’s source code. It raises concern, since threat actors might have exploited the vulnerability to deceive users into installing malicious apps.

Threat actors might have also used the access to add skimmers, which allow payment card stealers into the website’s online store that would have compromised fans and therefore harmed the club’s reputation.
Click to expand...

Log in or Sign up

400,000 websites vulnerable through exposed .git directories

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

400,000 websites vulnerable through exposed .git directories

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches