Using SVN makes your site extremely vulnerable • Hacker News Board

Re: Using SVN makes your site extremely vulnerable

#31

Post by masklinn » Wed, Sep 23, 2009, 1:23 PM UTC

chrismear wrote: post #12

masklinn wrote: post #7

Earlier quoted context omitted.

. It's especially bad because svn puts a .svn in each directory. With e.g. mercurial or git, you can tuck the (visible) site in a subdirectory of the repo itself (project/pages), and the .hg/.git (project/.hg|project/.git) won't be accessible. Of course the best option is still to use exports and symlinks.

Of course, it's not too tricky to configure, say, Apache to block access to all the .svn directories: http://www.subversionary.org/martintomes/preventing-access-t... http://blog.samdevore.com/archives/2006/05/01/hivelogic-prev...

Case in point to complement my previous post:

http://fr.php.net/.svn/entries secure

http://fr2.php.net/.svn/entries open

Re: Using SVN makes your site extremely vulnerable

#32

Post by DannoHung » Wed, Sep 23, 2009, 1:35 PM UTC

fdeth wrote: post #2

Sorry for the machine translation but an English text is not up just yet.

It's actually surprisingly coherent. Is Russian easier to translate than other languages or has Google's automated translation just gotten that good?

Re: Using SVN makes your site extremely vulnerable

#33

Post by gcv » Wed, Sep 23, 2009, 1:36 PM UTC

brown9-2 wrote: post #29

From the translation: It would seem that in the XXI century is difficult to find such a vulnerability. Do Russian speakers generally write the century in roman numerals like that? That's kind of neat..

Yes, it is customary in Russian writing to write century numbers in Roman numerals. The Russian language is going through a significant anglicization phase right now, though, so this will probably change.

Re: Using SVN makes your site extremely vulnerable

#34

Post by cousin_it » Wed, Sep 23, 2009, 1:37 PM UTC

Russian speaker here, I'll translate some selected comments for your convenience.

harm: We need more people who, upon finding a hole, go on to scan the whole Runet, for no nefarious reasons but just to warn unwitting site owners.

SilenceAndy: In olden times such people were called hackers, until journalists perverted that word to mean cyber criminals.

grayhex: This comment is impervious to Google Translate.

cancel: Google inurl:.svn/entries, lots of interesting stuff.

Nirvanko: This ain't new, see http://www.adamgotterer.com/2009/01/26/hacking-the-svn-direc...

SynteZ: IIS doesn't have this vulnerability :-) By default it doesn't send files without extensions, because it doesn't know the mime type.

varyen: Funny, Wii disks from SEGA also have .svn folders, though they're empty.

crazywebdev: Now I know how http://vkontakte.ru came about.

Re: Using SVN makes your site extremely vulnerable

#35

Post by ilyak » Wed, Sep 23, 2009, 1:48 PM UTC

DannoHung wrote: post #32

fdeth wrote: post #2

Sorry for the machine translation but an English text is not up just yet.

It's actually surprisingly coherent. Is Russian easier to translate than other languages or has Google's automated translation just gotten that good?

Russian language is indo-european, therefore the result is much better than if you're translating from chinese or turkish.

Google translate is good at lexical translation but still can't bind words together properly (and probably never will unless they'd change their paradigm).

I have to add that original text is surprisingly incoherent. They surely didn't re-read it after they wrote it.

Re: Using SVN makes your site extremely vulnerable

#36

Post by axod » Wed, Sep 23, 2009, 1:49 PM UTC

Title is misleading and plain wrong.

The issue is not in "using SVN". It's in using any revision control system that has .svn .git etc directories, and accidentally making those directories world readable from a webserver.

User error.

Re: Using SVN makes your site extremely vulnerable

#37

Post by [deleted] » Wed, Sep 23, 2009, 1:53 PM UTC

DannoHung wrote: post #32

fdeth wrote: post #2

Sorry for the machine translation but an English text is not up just yet.

It's actually surprisingly coherent. Is Russian easier to translate than other languages or has Google's automated translation just gotten that good?

[deleted]

Re: Using SVN makes your site extremely vulnerable

#38

Post by seedy » Wed, Sep 23, 2009, 2:01 PM UTC

We deploy like this, and it looks like I cannot get to the source files in the way described.

It appears that IIS is naively not serving up these file types. If I drop a plain html file in the .svn folder I can get to it, but any .svn-base file or files lacking an extension are unreachable.

Re: Using SVN makes your site extremely vulnerable

#39

Post by patio11 » Wed, Sep 23, 2009, 2:34 PM UTC

ionfish wrote: post #13

For your Apache config. # Disallow viewing of .svn and .git directory contents Order allow,deny Deny from all

For Nginx:

location ~ /\.(svn|git) { deny all; }

Re: Using SVN makes your site extremely vulnerable

#40

Post by dolinsky » Wed, Sep 23, 2009, 2:41 PM UTC

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

I will echo the sentiments of Sujan and masklinn. A production machine should not have a checked out version of a repository on it ever. If you want the ability to rollback, you have the last N exports of your repo in their versioned folders with a symlink from a 'current' folder pointing to the revision you want on live.

Don't blame the tool, blame the individual for using it improperly.