HexBrain

BTFS · Report #846400

.git file accessible on remote.bittorrent.com

Informativestatus
mediumseverity
4upvotes
11 May 2020disclosed

How it was found

Hi team, i detected your .git file accessible for any unauthorized user.

url : https://remote.bittorrent.com/static/webui/.git/config

HTTP/1.1 200 OK Set-Cookie: BTURT=talon-i-0837bbfadd509c546-2; path=/; domain=.utorrent.com Server: TornadoServer/2.1.1git Connection: keep-alive Content-Length: 260 Last-Modified: Wed, 18 Mar 2015 19:18:46 GMT Accept-Ranges: bytes Content-Type: text/html; charset=UTF-8 Cache-Control: public Cache-Control: private

[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = [email protected]:bittorrent/webui.git fetch = +refs/heads/:refs/remotes/origin/ [branch "master"] remote = origin merge = refs/heads/master

Impact

change perm for this

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original