Directory Traversal and Source code disclosure vulnerability


 (What's the main issue in the application?)

The web server exposes a Source Code via version control system - Git.

The Directory Listing feature that was enabled on the server side is discloses the directories that stores sensitive files that are related to the Source Code

(Who can access? What are the possible risks)

An external attacker may download the source code and disclose sensitive information regarding the development and possibly other sensitive data.

In the application I found two ways of disclosing source code.

Instance#1:

After performing nikto I found directories as shown 

An attacker may use automated tools to discover, download and extract git repositories. https://github.com/internetwache/GitTools



Note: Due to the fact that the server has Directory Listing feature enabled, makes even easier to download the git repositories using simple wget command. wget --mirror -I .git TARGET.COM/.git/

Instance#2: 

The attacker may run Directory Fuzzing attack and disclose directories that stores sensitive files.

/backend 

/test

/frontend

/test directory stores server.js file./frontend directory stores different files and backup files.
Recommendations: 
(Tips for mitigating the issue.)

Either remove the git folder from your webserver or ensure that you deny all access to the .git folders.
Disable Directory Listing on the server.
Disable unprotected HTTP protocol and enable HTTPS protocol only.

References:
https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/






Comments

Post a Comment

Popular posts from this blog

File Upload Security Testing Checklists

  Security Checklist Are filenames reflected back on the page? If so, are they HTML Entity encoded (XSS via file names)? Does it accept .zip files? Try a  ZipSlip If it processes an image, check for  Image Tragick (CVE-2016-3714) Can you bypass file type restrictions by changing the content-type value? Can you bypass file type restrictions by  forging valid magic bytes ? Can you upload a file with a less-common extension (such as .phtml)? Try playing with the filename in the request, a potential vector for traversal or SQL injection. Check for the acceptance of double extensions on uploaded files. Test for  null-byte injection . Is the server windows? Try adding a  trailing  .  to bypass extension blacklists , this dot will be removed automatically by the OS. Can you upload an  SVG for XSS ? If supported by the webserver, can you  upload .htaccess files ? Does the backend process the image with the  PHP GD library ? Is the app vulnerable to the  infamous ffmpeg exploit ? Can custom pol
Read more

SAML Security Test Cases

Signature Exclusion Attack -Test whether or not the SP accepts an Assertion without a Signature  Signature Spoofing attack -Test whether SP accepts fake signature or using previously generated/invalid signature Signature Wrapping Attack (8 Different Ways)-Test whether or not the SP is susceptible to Signature Wrapping XML Injection -Test if can inject malicious code into the SAML response from IDP, allowing them to execute arbitrary code on the SP server. XML Entity Expansion (XEE)/XXE -Test whether or not the SP is vulnerable to XML External Entities Replay attacks -Test if previously generated SAML response from IDP can be accepted by SP Certificate Faking/Self signed certificate -Test whether or not the SP verifies that the Assertion came from a trusted IDP/Test if SP accepts self-signed certificate XSLT Injection -Test whether or not the SP is vulnerable to XSLT Predictable signature -Test whether IDP generating guessable signature SAML message expiration -Test whether SP accepts
Read more

Drozer - A Framework for Android Application Security Assessment.

Image
1.             Introduction 1.1   This document explains how to get started with Drozer, and how to use it to perform a security assessment of an android application. 1.1.      Drozer Drozer is a python based comprehensive security audit and attack framework for Android. It is an open-source framework, used for android pen-testing. It works like a client-server model and makes use of Android’s Inter-Process Communication (IPC) mechanism to interact with the underlying operating system of the device. IPC is a mechanism by which different components of android like intents and data binders communicate with each other so that the communication is established between the apps present in the android device. Drozer helps to remotely exploit android devices with predefined and custom modules that exploit known vulnerabilities. 1.2.      Conventions used Throughout this document, command-line examples will use one of two prefixes: dz> indicates that the command shou
Read more