Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One in every 600 websites has .git exposed

jamiembrown.com

Post reply on HN
Print view View original

161–170 of 214 posts

Re: One in every 600 websites has .git exposed

#161

Post by raverbashing »

quicksilver03 wrote: post #159

Some of the other commenters suggest adding git-dir and work-tree to the git commands, but there's a better solution: use the --separate-git-dir option when cloning the repository. For example: git clone --separate-git-dir= where is outside of any directory served by the web server and is the htdocs root. This option makes /.git a file whose content is: gitdir: The advantage is that all git commands work as usual, wi…

I disagree

It may be possible that gitdir is still accessible through a misconfiguration or security issue (and you're giving them exactly where to look)

Production servers have no business having the .git directory anywhere.

Re: One in every 600 websites has .git exposed

#162

Post by yrro »

smtddr wrote: post #115
alexisnorman wrote: post #107

Earlier quoted context omitted.

I'm surprised this isn't higher up. Are there any arguments against ENV variables in favor of something else?

Here's my caution to this. If low level processes can do "ps aux", and they see something like: DB_USER=scott DB_PASSWORD=b3withm3pl3aze /usr/bin/python webapp.py That could be troublesome if an attacker figured out a way to run remote commands on your server even as an unprivileged user.

Reading the environment of another process is a privileged operation.

Re: One in every 600 websites has .git exposed

#163

Post by georgerobinson »

I once jumped-in on a PHP project where the previous developers had written:

    $page = $_GET['page'];
    include ($page.".php");
Whilst allow_url_include (http://php.net/manual/en/filesystem.configuration.php#ini.al...) was set to false, I could still craft a URL like:

http://example.com/?page=admin/index

which expanded to http://example.com/index.php?page=admin/index where the real admin was at http://example.com/admin/index.php and offered complete access to the backend without authentication or authorization - let alone other files in the file system.

In another project, I found that the server had register globals turned on, and therefore could craft a URL like:

http://example.com/admin?valid_user=1, where valid_user was a PHP variable set to true iff their session cookie could be authenticated in the database.

I think it's terrifying that these things still make it through to production websites

Re: One in every 600 websites has .git exposed

#164

Post by mdpopescu »

gabetax wrote: post #84
dangero wrote: post #68

Earlier quoted context omitted.

Where is the right place to store db passwords, api keys, etc? What is best practice in this area?

You can use a datastore like HashiCorp's vault: https://vaultproject.io

Windows has something similar in DPAPI - https://msdn.microsoft.com/en-us/library/ms995355.aspx

Re: One in every 600 websites has .git exposed

#165

Post by TazeTSchnitzel »

juliangregorian wrote: post #158
vog wrote: post #145

Earlier quoted context omitted.

You seem to imply this is a novel attack vector. But it's really just an instance of a very old mistake: Don't use the root of your app as document root! It's really as simple as that. Almost all modern apps have a subdirectory "public/" or similar. That one is meant to be used as document root. You only have to ensure there are no sensitive files in there . If you fail to introduce such a directory, you'll have a ga…

Great point. How much do you want to bet most of these are PHP, where it takes special discipline not to make your top directory web-accessible?

Does it? If you're on a shared host with just the one directory, maybe. But if you are configuring your own server, you still point it to htdocs and keep the config below it.

Re: One in every 600 websites has .git exposed

#166

Post by TazeTSchnitzel »

aikah wrote: post #140

It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root folder of the project thus exposing .git (and the rest). Classic dumb error by PHP developers. I have hard time believing one would be able to expose the .git folder in a Rails,Spring or Django application since the public folder isn't the root folder of the…

PHP? Static sites, ASP sites, CGI sites, these would also be vulnerable. Don't be so quick to laugh.

Re: One in every 600 websites has .git exposed

#168

Post by shutupbitch »

tokenizerrr wrote: post #156
jsjohnst wrote: post #120

Earlier quoted context omitted.

Glad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you shouldn't do this in your apps, but one super obvious one is there's way to many frameworks that expose environment variables in their debug output if not properly configured. Think you'll never misconfigure a server? Guess again, pretty much every major site (Go…

Please review HN's guidelines on civility.

Nothing uncivil about his/her response, you just need thicker skin.

Re: One in every 600 websites has .git exposed

#169

Post by tokenizerrr »

shutupbitch wrote: post #168
tokenizerrr wrote: post #156

Earlier quoted context omitted.

Please review HN's guidelines on civility.

Nothing uncivil about his/her response, you just need thicker skin.

I'm glad you made a new account named 'shutupbitch' just to tell me this. Thank you for your contribution.

Re: One in every 600 websites has .git exposed

#170

Post by vidarh »

yrro wrote: post #162
smtddr wrote: post #115

Earlier quoted context omitted.

Here's my caution to this. If low level processes can do "ps aux", and they see something like: DB_USER=scott DB_PASSWORD=b3withm3pl3aze /usr/bin/python webapp.py That could be troublesome if an attacker figured out a way to run remote commands on your server even as an unprivileged user.

Reading the environment of another process is a privileged operation.

The example above is someone who have stupidly started a process with the environment variables exposed on the command line
Post reply on HN