Experts discovered millions of .git folders exposed to public

Nearly two million .git folders containing vital project information are exposed to the public, the Cybernews research team found.

Original Post at https://cybernews.com/security/millions-git-folders-exposed/

Git is the most popular open-source, distributed version control system (VCS) developed nearly 20 years ago by Linus Torvalds for development of the Linux kernel, with other kernel developers contributing to its initial development. It allows to coordinate work among programmers developing source code and allows tracking of changes.

A .git folder contains essential information about projects, such as remote repository addresses, commit history logs, and other essential metadata. Leaving this data in open access can lead to breaches and system exposure.

For example, another recent research by Cybernews discovered that CarbonTV, a US-based streaming service, left a server with its source code open, risking user safety and the company’s reputation. The source code was leaking due to poor control of access to the .git folder.

Researchers at Cybernews on most common web service ports 80 and 443 revealed 1,931,148 IP addresses with live servers that had .git folder structure accessible to the public.

“Having public access to the .git folder could lead to the exposure of the source code. Tools required to get parts or full source code from the .git folder are free and well-known, which could lead to many more internal leaks or easier access to the system for a malicious actor,” Martynas Vareikis, a researcher at Cybernews, said.

Over 31% of publicly exposed .git folders are located in the US, followed by China (8%) and Germany (6.5%.)

Around 6.3% of exposed .git configuration files had their deployment credentials in the configuration file itself.

“Credential leaks are even worse. Threat actors could use them to view/access/pull/push all repositories, opening up even more opportunities for a malicious actor, such as planting malicious ads, changing content, and credit card skimming. Possibilities are endless when you have full access,” Vareikis warned.

He said developers need to make use of the .gitignore file, telling Git which files to ignore when committing a project to the GitHub repository. In general, it’s never a good idea to commit anything sensitive, even to private repositories.

CyberNews experts noticed that it is still a common practice to leave publicly exposed web servers accessible via IPs. Domain names, such as cybernews.com, are designed for users to remember and access them easily, but they function as aliases for IP addresses expressed in a sequence of numbers. Focused on protecting the main domain address used by the public, developers often forget to set the same access control rules to corresponding IP addresses, which could result in threat actors modifying the domain and configuring access rules, among other things.

Original Post at https://cybernews.com/security/millions-git-folders-exposed/

About the author: Jurgita Lapienytė, Chief Editor at CyberNews 

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, .git)

[adrotate banner=”5″]

[adrotate banner=”13″]