The following URL (usually /.git/config
) is publicly accessible and is leaking source code and repository configuration.
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652267d8ba03
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = https://github.com/youth7/myblog.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "master"] remote = origin merge = refs/heads/master
An attacker can make use of this vulnerability to step out of the root directory and access other parts of the file system.
This might give the attacker the ability to view restricted files, which could provide the attacker with more information required to further compromise the system.
https://www.acunetix.com/websitesecurity/directory-traversal/
Severity: critical
Fingerprint: ac4d53c4832b2491c591c07da47c3668e4dde730b1c2db06b1c2db06d5a398fb
Found host file trough Directory traversal: 127.0.0.1 vm-0-4-centos vm-0-4-centos 127.0.0.1 localhost.localdomain localhost 127.0.0.1 localhost4.localdomain4 localhost4 ::1 vm-0-4-centos vm-0-4-centos ::1 localhost.localdomain localhost ::1 localhost6.localdomain6 localhost6 140.82.112.4 github.com 185.199.108.133 raw.githubusercontent.com
Severity: critical
Fingerprint: ac4d53c4832b2491c591c07da47c3668e4dde730b1c2db06b1c2db06d3d8ebc5
Found host file trough Directory traversal: 127.0.0.1 vm-0-4-centos vm-0-4-centos 127.0.0.1 localhost.localdomain localhost 127.0.0.1 localhost4.localdomain4 localhost4 ::1 vm-0-4-centos vm-0-4-centos ::1 localhost.localdomain localhost ::1 localhost6.localdomain6 localhost6
Severity: critical
Fingerprint: ac4d53c4832b2491752255c442649e238a0b8061f0f932c7f0f932c7948eb0bc
Found host file trough Apache traversal: 127.0.0.1 vm-0-4-centos vm-0-4-centos 127.0.0.1 localhost.localdomain localhost 127.0.0.1 localhost4.localdomain4 localhost4 ::1 vm-0-4-centos vm-0-4-centos ::1 localhost.localdomain localhost ::1 localhost6.localdomain6 localhost6