Page MenuHomePhabricator
Create Task
Maniphest T306514

Microsites exposing git folder
Closed, ResolvedPublicSecurity
Actions

Description

Similar to {T294917}.

The following microsites expose their .git folder to the web. While this isn't necessarily an issue for ourselves as the repos are public, they do result in some false positive security reports.

https://analytics.wikimedia.org/.git/config
https://annual.wikimedia.org/.git/config
https://bienvenida.wikimedia.org/.git/config
https://design.wikimedia.org/.git/config
https://research.wikimedia.org/.git/config

Details

Risk Rating
Low
Author Affiliation
WMF Technology Dept
SubjectRepoBranchLines +/-
microsites: block access to .git folder on various sitesoperations/puppetproduction+54 -0
Customize query in gerrit

Event Timeline

Reedy created this task.Apr 20 2022, 12:17 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 20 2022, 12:17 PM
Reedy triaged this task as Lowest priority.Apr 20 2022, 12:19 PM
Reedy added a project: Wikimedia-Apache-configuration.
Reedy updated the task description. (Show Details)
Mstyles claimed this task.Apr 26 2022, 8:52 PM
Mstyles moved this task from Incoming to In Progress on the Security-Team board.
Mstyles subscribed.

Going to see whether this can be addressed in the repo or on the webserver to prevent the ,git folder from appearing on the web

Mstyles added projects: Vuln-Misconfiguration, SecTeam-Processed.May 5 2022, 7:47 PM
Mstyles changed Risk Rating from N/A to Low.
Reedy updated the task description. (Show Details)Jun 1 2022, 12:39 PM
Lucas_Werkmeister_WMDE subscribed.Jul 19 2022, 2:11 PM

Fixed in https://gerrit.wikimedia.org/r/c/operations/puppet/+/815290.

sbassett closed this task as Resolved.Jul 19 2022, 5:17 PM
sbassett reassigned this task from Mstyles to Lucas_Werkmeister_WMDE.
sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.
sbassett subscribed.
In T306514#8087732, @Lucas_Werkmeister_WMDE wrote:

Fixed in https://gerrit.wikimedia.org/r/c/operations/puppet/+/815290.

Rad, thanks. This definitely appears to fix the URLs mentioned within the task description.

sbassett changed Author Affiliation from N/A to WMF Technology Dept.Jul 19 2022, 5:17 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
taavi claimed this task.Jul 19 2022, 5:58 PM
RhinosF1 subscribed.Jul 19 2022, 6:13 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits