Playing with fire: millions of .git folders exposed to public

Nearly two million .git folders containing vital project information are exposed to the public, the Cybernews research team found.

Git is the most popular open-source, distributed version control system (VCS) developed nearly 20 years ago by Finnish-American software engineer Linus Torvalds. It coordinates work among programmers developing source code and allows to track changes.

A .git folder contains essential information about projects, such as remote repository addresses, commit history logs, and other essential metadata. Leaving this data in open access can lead to breaches and system exposure.

For example, another recent research by Cybernews discovered that CarbonTV, a US-based streaming service, left a server with its source code open, risking user safety and the company’s reputation. The source code was leaking due to poor control of access to the .git folder.

Despite the importance of that information, recent Cybernews research of the Internet Protocol version 4 (IPv4), specifically, most common web service ports 80 and 443, demonstrated that it’s not always taken care of well.

We have detected 1,931,148 IP addresses with live servers that had .git folder structure accessible to the public.

“Having public access to the .git folder could lead to the exposure of the source code. Tools required to get parts or full source code from the .git folder are free and well-known, which could lead to many more internal leaks or easier access to the system for a malicious actor,” Martynas Vareikis, a researcher at Cybernews, said.

Over 31% of publicly exposed .git folders are located in the US, followed by China (8%) and Germany (6.5%.)

While digging a little bit deeper, we discovered that around 6.3% of exposed .git configuration files had their deployment credentials in the configuration file itself.

“Credential leaks are even worse. Threat actors could use them to view/access/pull/push all repositories, opening up even more opportunities for a malicious actor, such as planting malicious ads, changing content, and credit card skimming. Possibilities are endless when you have full access,” Vareikis warned.

He said developers need to make use of the .gitignore file, telling Git which files to ignore when committing a project to the GitHub repository. In general, it’s never a good idea to commit anything sensitive, even to private repositories.

Our researchers noticed that it is still a common practice to leave web servers accessible via IPs. Domain names, such as cybernews.com, are designed for users to remember and access them easily, but they function as aliases for IP addresses expressed in a sequence of numbers. Focused on protecting the main domain address used by the public, developers often forget to set the same access control rules to corresponding IP addresses, which could result in threat actors modifying the domain and configuring access rules, among other things.