Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using SVN makes your site extremely vulnerable

translate.google.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Using SVN makes your site extremely vulnerable

#41

Post by peterwwillis »

walesmd wrote: post #22

This isn't really a vulnerability - just developers not doing their job. Anyone who uses SVN (or any other version management system, for that matter) should know how it works. I know SVN creates these hidden directories (named .svn) within every directory of my project that contains the working copies of the files within that directory. Therefore I either use export (to not upload the hidden folders) or I make them…

People mis-configure Apache all the time. They leave their site wide open for attack. They're vulnerable.

Saying it's not a vulnerability when 3,000 sites all have their source code visible to the world is like having your arm chopped off and saying "no it isn't, it's just a flesh wound."

I know it's not a cool remote root buffer overflow exploit hat trick 540 front side flip, but it's a security hole which people need to be educated about.

Re: Using SVN makes your site extremely vulnerable

#42

Post by jerf »

AndrewDucker wrote: post #23
InclinedPlane wrote: post #16

Earlier quoted context omitted.

Just reading. This is actually pretty bad. Consider all of the passwords embedded in connection strings and all the other various secrets contained in the source AND configuration files for a standard website. Even if your site uses all open source software, you still don't want J. Random Hacker to have write access to your database, for example.

Of course, you database _really_ shouldn't be externally visible...

Well, don't forget about "security-in-depth". Combine "DB password on your website" with "remote unprivileged shell" on any server that can reach the DB, and now you've got a "shell into the DB".

Security exploits aren't just bad for what they directly allow, they are bad for how they often combine well.

(You, AndrewDucker, may already know this; I'm not trying to imply otherwise. I'm saying this because this is a point that needs to be made more often, too many people ignore it. Any unauthorized access into your system needs to be taken very seriously, because of this risk.)

Re: Using SVN makes your site extremely vulnerable

#44

Post by walesmd »

peterwwillis wrote: post #41
walesmd wrote: post #22

This isn't really a vulnerability - just developers not doing their job. Anyone who uses SVN (or any other version management system, for that matter) should know how it works. I know SVN creates these hidden directories (named .svn) within every directory of my project that contains the working copies of the files within that directory. Therefore I either use export (to not upload the hidden folders) or I make them…

People mis-configure Apache all the time. They leave their site wide open for attack. They're vulnerable. Saying it's not a vulnerability when 3,000 sites all have their source code visible to the world is like having your arm chopped off and saying "no it isn't, it's just a flesh wound." I know it's not a cool remote root buffer overflow exploit hat trick 540 front side flip, but it's a security hole which people ne…

But Apache isn't misconfigured in this instance - a file was uploaded and people are claiming that being able to view that file is a vulnerability.

I guess it is a vulnerability of the same standard as "My password is: password".

I just don't understand why everyone is up-in-arms and so surprised by this "vulnerability." It's common sense...

Re: Using SVN makes your site extremely vulnerable

#45

Post by bcl »

ionfish wrote: post #13

For your Apache config. # Disallow viewing of .svn and .git directory contents Order allow,deny Deny from all

May as well throw in .hg

Oh. Now we're blacklisting.

If you are going to use this solution, you are better off blacklisting all dotfiles except .htaccess, assuming you allow it.

Re: Using SVN makes your site extremely vulnerable

#46

Post by ionfish »

bcl wrote: post #45
ionfish wrote: post #13

For your Apache config. # Disallow viewing of .svn and .git directory contents Order allow,deny Deny from all

May as well throw in .hg Oh. Now we're blacklisting. If you are going to use this solution, you are better off blacklisting all dotfiles except .htaccess, assuming you allow it.

Even if you do use .htaccess files, you still shouldn't be showing them to anyone who requests them from your web server!

Re: Using SVN makes your site extremely vulnerable

#47

Post by bcl »

ionfish wrote: post #46
bcl wrote: post #45

Earlier quoted context omitted.

May as well throw in .hg Oh. Now we're blacklisting. If you are going to use this solution, you are better off blacklisting all dotfiles except .htaccess, assuming you allow it.

Even if you do use .htaccess files, you still shouldn't be showing them to anyone who requests them from your web server!

Ha! Correct!

Re: Using SVN makes your site extremely vulnerable

#48

Post by thismat »

masklinn wrote: post #7
Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

. It's especially bad because svn puts a .svn in each directory. With e.g. mercurial or git, you can tuck the (visible) site in a subdirectory of the repo itself (project/pages), and the .hg/.git (project/.hg|project/.git) won't be accessible. Of course the best option is still to use exports and symlinks.

Spot on. Even with proper auth rules it would still trouble me knowing I had my source exposed to the world. I'm a big fan of exports and now, thanks to you and masskin(sp?), really digging the symlinks idea.
Post reply on HN