3 ms·
It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root
by aikah 11y ago
It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root folder of the project thus exposing .git (and the rest). Classic dumb error by PHP developers. I have hard time believing one would be able to expose the .git folder in a Rails,Spring or Django application since the public folder isn't the root folder of the project.
I wish servers would be configured so they don't server ^\..+$ files by default. I wish servers would behave as secure as possible then it's up to the developer to whitelist features rather than the other way around.
- realityking 11y agoExcluding anything that starts with a period also doesn't work - RFC 5785 specs the folder .well-known with special meaning.
- samuellb 11y agoTrue, but you can whitelist /.well-known/. I don't think anything else uses dot-filenames in URLs, because not all operating systems and software even allow such file names (for instance, the file browser in Windows forbids it when creating a new file or folder).
- TazeTSchnitzel 11y agoPHP? Static sites, ASP sites, CGI sites, these would also be vulnerable. Don't be so quick to laugh.