5 ms·

Way back when I saw a report on hackernews about secret exposure from websites that deployed directly via a git repo as a webroot and didn't block access to .gi

Way back when I saw a report on hackernews about secret exposure from websites that deployed directly via a git repo as a webroot and didn't block access to .git/ I added a cheeky message to my site's .git/ folder if you attempted to view it. About 2 or 3 months later I started getting "security reports" to the catch all, about an exposed git folder that was leaking my website's secrets. Apparently because my site didn't return 404, their script assumed i was exposed and they oh so helpfully reported it to me. Got like 4 or 5 before i decided to make it 404 so they would stop, mainly because i didn't want to bring false positive fatigue on to "security exploit" subject line emails. I have a feeling CNAs are bringing this kind of low effort zero regard for false positive fatigue bullshit to CVEs. Might as well just rip that bandaid off now and stop trusting anything besides the debian security mailing list.

pixl97 6y ago
Is there a way to return a custom 404 error handler for .git and a different one for a regular 404 in Apache? Never tried that before.
- TonyTrapp 6y ago
  Check the ErrorDocument directive for .htaccess files.
  - hnlmorg 6y ago
    That directive doesn't have to reside in .htaccess files. It works just as well inside a Directory, Virtual Host and Server contexts as well. ErrorDocument 404 /404.php <Directory "/.git"> ErrorDocument 404 "Ah ah ah! You didn't say the magic word" </Directory> https://httpd.apache.org/docs/2.4/mod/core.html#errordocument https://httpd.apache.org/docs/2.4/mod/core.html#errordocumen...
cipherboy 6y ago
> I have a feeling CNAs are bringing this kind of low effort zero regard for false positive fatigue bullshit to CVEs. Might as well just rip that bandaid off now and stop trusting anything besides the debian security mailing list. Red Hat (my employer), Canonical, and SUSE are also CNAs. I can only speak to ours, but I think our prodsec team does a great job with the resources they've been given. Nobody is perfect, but if you take the time to explain the problem (invalid CVE, wrong severity, bad product assignment, ...) they consistently take the time to understand the issue and will work with whatever other CNA or reporter to fix it. Generally we have a public tracker for unembargoed CVEs, so if it affects us and isn't legitimate or scoped correctly, you might get somewhere by posting there (or the equivalent on Ubuntu/SUSE's tracker). Perhaps it is just the nature of the open source community Linux distros are a part of, though, that lets them apply it to CVEs as well. Doesn't help with personal reports though. :-) Curious, did you get CVE assignments against your personal site? 0.o
thaumasiotes 6y ago
> I have a feeling CNAs are bringing this kind of low effort zero regard for false positive fatigue bullshit to CVEs. Yes, being the discoverer of a CVE is a major resume item. Pen testers who have a CVE to their name can charge more. Companies can charge more for sending them.
seanwilson 6y ago
> Apparently because my site didn't return 404, their script assumed i was exposed and they oh so helpfully reported it to me. There's no good reason that folder should exist except for a joke, so how is this not a helpful message in the vast majority of cases? All lint rules have exceptions, doesn't make them not useful.
- waihtis 6y ago
  Well according to the post, the OP returned a cheeky message and any MK I Eyeball should clearly spot it as an intended condition. Automated scan-spam gets on your nerves pretty quickly. I run a small vulnerability disclosure program and receive a ton of it - people clearly run automated scanners, which I presume create automated vulnerability reports, on things that are not even remotely dangerous AND have been specifically ruled out of scope for the program. It's not helpful, it's time consuming and often people will complain if you don't answer their reports.
- ryanlol 6y ago
  This is not a helpful message in the vast majority of cases. Lots of servers out there that always return 200
  - seanwilson 6y ago
    > Lots of servers out there that always return 200 That's poor configuration for most public websites that you want indexed by search bots that's worth fixing. It's called a soft 404, and makes it troublesome to detect when links are invalid, break or have moved. Google will even warn you about it: https://developers.google.com/search/docs/advanced/crawling/soft-404-errors https://developers.google.com/search/docs/advanced/crawling/...
    - ryanlol 6y ago
      The vast majority of servers on port 80 are not public websites that you want indexed by search bots.
- 6y ago
cperciva 6y ago
Speaking of "security exploits" consisting of reading publicly available information: Tarsnap has public mailing lists with public mailing list archives, and at least once a month I get an email warning me that my "internal emails" are accessible.
csnover 6y ago
Be thankful you only receive automated security reports about an open .git directory. There is some guy/company who goes around running a web spider connected to some shitty antivirus which automatically submits false abuse reports to site ISPs claiming that their customers are hosting viruses. This happened to me twice; I think after the second time my ISP started rejecting these reports outright since I haven’t seen any new ones for a few years now, even though they’re clearly still at it (or, maybe, finally stopped last year after getting DDoSed?)[0]. Automated security scanning by people who don’t know what they are doing has become an enormous hassle in so many ways and really is damaging the ability to find and handle true threats. [0] https://twitter.com/badlogicgames/status/1267850389942042625 https://twitter.com/badlogicgames/status/1267850389942042625
Shank 6y ago
This is quite common. If you run a security@ mailbox at a company, you're bound to receive hundreds of bug bounty/responsible disclosure requests because of known software quirks or other design choices. They'll cite precisely one CVE or HackerOne/BugCrowd report, and then proceed to demand a huge payment for a critical security flaw. I've seen reports that easily fail the airtight hatchway [0] tests in a variety of ways. Long cookie expiration? Report. Any cookie doesn't have `Secure`, including something like `accepted_cookie_permissions`? Report. Public access to an Amazon S3 bucket used to serve downloads for an app? Report. WordPress installed? You'll get about 5 reports for things like having the "pingback" feature enabled, having an API on the Internet, and more. The issue is that CVEs and prior-art bug bounty payments seem "authoritative" and once they exist, they're used as reference material for submitting reports like this. It teaches new security researchers that the wrong things are vulnerabilities, which is just raising a generation of researchers that look for the entirely wrong things. [0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- VectorLock 6y ago
  You're absolutely right I get a barrage of these. I've got to think someone out there is selling software to scan for these and spam them around.
- STRML 6y ago
  Can confirm this; we've gotten more than 20 reports and demands for bounties for "public access" on our open data subdomain (backed by S3), which literally is `public.`. Then they beg to have the report closed as "informative". We don't comply unless it really is an honest mistake; I don't like the idea of low-quality reporters evading consequences again and again, sending scattershot bug reports in a desperate attempt to catch a team not paying attention.
- bostik 6y ago
  Yup, according to these "researchers" having robots.txt on your website is enough to warrant a CRITICAL vulnerability. No, I'm not joking. That's one of the reports I saw in November. I've also had to triage the claim that our site supposedly has a gazillion *.tar.xz files available at the root. All because the 404 handler for random [non-production relevant] paths is a fixed page with 200 response. As far as I'm concerned, running a bulk vulnerability scanner against a website and not even checking the results has as much to do with security research as ripping wings off of flies has to do with bioengineering.
jeltz 6y ago
How do they contact you? I have never got any report.
- MrStonedOne 6y ago
  emails to addresses like security@domain.name or webmaster@

pixl97 6y ago

Is there a way to return a custom 404 error handler for .git and a different one for a regular 404 in Apache? Never tried that before.

TonyTrapp 6y ago
Check the ErrorDocument directive for .htaccess files.
- hnlmorg 6y ago
  That directive doesn't have to reside in .htaccess files. It works just as well inside a Directory, Virtual Host and Server contexts as well. ErrorDocument 404 /404.php <Directory "/.git"> ErrorDocument 404 "Ah ah ah! You didn't say the magic word" </Directory> https://httpd.apache.org/docs/2.4/mod/core.html#errordocument https://httpd.apache.org/docs/2.4/mod/core.html#errordocumen...

cipherboy 6y ago

> I have a feeling CNAs are bringing this kind of low effort zero regard for false positive fatigue bullshit to CVEs. Might as well just rip that bandaid off now and stop trusting anything besides the debian security mailing list. Red Hat (my employer), Canonical, and SUSE are also CNAs. I can only speak to ours, but I think our prodsec team does a great job with the resources they've been given. Nobody is perfect, but if you take the time to explain the problem (invalid CVE, wrong severity, bad product assignment, ...) they consistently take the time to understand the issue and will work with whatever other CNA or reporter to fix it. Generally we have a public tracker for unembargoed CVEs, so if it affects us and isn't legitimate or scoped correctly, you might get somewhere by posting there (or the equivalent on Ubuntu/SUSE's tracker). Perhaps it is just the nature of the open source community Linux distros are a part of, though, that lets them apply it to CVEs as well. Doesn't help with personal reports though. :-) Curious, did you get CVE assignments against your personal site? 0.o

thaumasiotes 6y ago

> I have a feeling CNAs are bringing this kind of low effort zero regard for false positive fatigue bullshit to CVEs. Yes, being the discoverer of a CVE is a major resume item. Pen testers who have a CVE to their name can charge more. Companies can charge more for sending them.

seanwilson 6y ago

> Apparently because my site didn't return 404, their script assumed i was exposed and they oh so helpfully reported it to me. There's no good reason that folder should exist except for a joke, so how is this not a helpful message in the vast majority of cases? All lint rules have exceptions, doesn't make them not useful.

waihtis 6y ago
Well according to the post, the OP returned a cheeky message and any MK I Eyeball should clearly spot it as an intended condition. Automated scan-spam gets on your nerves pretty quickly. I run a small vulnerability disclosure program and receive a ton of it - people clearly run automated scanners, which I presume create automated vulnerability reports, on things that are not even remotely dangerous AND have been specifically ruled out of scope for the program. It's not helpful, it's time consuming and often people will complain if you don't answer their reports.
ryanlol 6y ago
This is not a helpful message in the vast majority of cases. Lots of servers out there that always return 200
- seanwilson 6y ago
  > Lots of servers out there that always return 200 That's poor configuration for most public websites that you want indexed by search bots that's worth fixing. It's called a soft 404, and makes it troublesome to detect when links are invalid, break or have moved. Google will even warn you about it: https://developers.google.com/search/docs/advanced/crawling/soft-404-errors https://developers.google.com/search/docs/advanced/crawling/...
  - ryanlol 6y ago
    The vast majority of servers on port 80 are not public websites that you want indexed by search bots.
6y ago

cperciva 6y ago

Speaking of "security exploits" consisting of reading publicly available information: Tarsnap has public mailing lists with public mailing list archives, and at least once a month I get an email warning me that my "internal emails" are accessible.

csnover 6y ago

Be thankful you only receive automated security reports about an open .git directory. There is some guy/company who goes around running a web spider connected to some shitty antivirus which automatically submits false abuse reports to site ISPs claiming that their customers are hosting viruses. This happened to me twice; I think after the second time my ISP started rejecting these reports outright since I haven’t seen any new ones for a few years now, even though they’re clearly still at it (or, maybe, finally stopped last year after getting DDoSed?)[0]. Automated security scanning by people who don’t know what they are doing has become an enormous hassle in so many ways and really is damaging the ability to find and handle true threats. [0] https://twitter.com/badlogicgames/status/1267850389942042625 https://twitter.com/badlogicgames/status/1267850389942042625

Shank 6y ago

This is quite common. If you run a security@ mailbox at a company, you're bound to receive hundreds of bug bounty/responsible disclosure requests because of known software quirks or other design choices. They'll cite precisely one CVE or HackerOne/BugCrowd report, and then proceed to demand a huge payment for a critical security flaw. I've seen reports that easily fail the airtight hatchway [0] tests in a variety of ways. Long cookie expiration? Report. Any cookie doesn't have `Secure`, including something like `accepted_cookie_permissions`? Report. Public access to an Amazon S3 bucket used to serve downloads for an app? Report. WordPress installed? You'll get about 5 reports for things like having the "pingback" feature enabled, having an API on the Internet, and more. The issue is that CVEs and prior-art bug bounty payments seem "authoritative" and once they exist, they're used as reference material for submitting reports like this. It teaches new security researchers that the wrong things are vulnerabilities, which is just raising a generation of researchers that look for the entirely wrong things. [0]: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

VectorLock 6y ago
You're absolutely right I get a barrage of these. I've got to think someone out there is selling software to scan for these and spam them around.
STRML 6y ago
Can confirm this; we've gotten more than 20 reports and demands for bounties for "public access" on our open data subdomain (backed by S3), which literally is `public.`. Then they beg to have the report closed as "informative". We don't comply unless it really is an honest mistake; I don't like the idea of low-quality reporters evading consequences again and again, sending scattershot bug reports in a desperate attempt to catch a team not paying attention.
bostik 6y ago
Yup, according to these "researchers" having robots.txt on your website is enough to warrant a CRITICAL vulnerability. No, I'm not joking. That's one of the reports I saw in November. I've also had to triage the claim that our site supposedly has a gazillion *.tar.xz files available at the root. All because the 404 handler for random [non-production relevant] paths is a fixed page with 200 response. As far as I'm concerned, running a bulk vulnerability scanner against a website and not even checking the results has as much to do with security research as ripping wings off of flies has to do with bioengineering.

jeltz 6y ago

How do they contact you? I have never got any report.

MrStonedOne 6y ago
emails to addresses like security@domain.name or webmaster@