Please Fix: Git Repositories Are Insecure By Default

When you create a new Git application on WebFaction's control panel, a .htpasswd file is created with world-readable permissions. This means that anyone can access your private repositories by browsing to http://domain.com/path/to/git/.htpasswd, which contains a username and password-hash. (First the hash needs to be cracked, but that is easily done.)

To fix this:
1. The Git installer should set proper permissions on the .htpasswd file
2. Apache should be setup to protect all .htaccess and .htpasswd files, no matter what their file permissions are. (That is actually the default on Debian.)

Until one of those solutions can be implemented, I recommend updating the docs at http://docs.webfaction.com/software/git.html so that users can secure their repositories themselves.

I've posted a tad more information (and a line-by-line guide to securing your repositories) on my blog.

security git .htpasswd

asked Jan 11 '11 at 13:51

nyellin
6●5

One Answer:

oldest newest most voted

This is not supposed to happen. I just checked this on my own account and can verify that it is not the case,

1
2
3

[root@web162 git]# ls -la
-rw-r--r--  1 lucidsky lucidsky    767 Jan 11 15:36 .htaccess
-rw-r--r--  1 lucidsky lucidsky     23 Jan 11 15:36 .htpasswd

Also when I visited http://domain.com/.htaccess I was prompted with an auth, so it is not world readable. Could you please submit a support ticket so we can see why your account did this?

answered Jan 11 '11 at 15:40

johns ♦♦
3454●2●7

I've done some more testing in a clean browser and I can reproduce this again. As you pointed out, .htaccess is protected, but .htpasswd is not protected.

To test this, I recommend creating a new git application from the control panel, as this will (temporarily) expose your repositories. If you want to test on your existing git application, then:
1. Make sure you have the default .htaccess file (which doesn't restrict access to ^.ht files.
2. Make sure that both .htaccess and .htpasswd have world-readable permissions (i.e. -rw-r--r--)

(Jan 12 '11 at 01:57) nyellin

When fixing this, keep in mind that git repositories which have enabled anonymous read-only access don't use any sort of authentication at all. So there's also an easy privilege escalation attack right now.

(Jan 12 '11 at 02:06) nyellin

When I visit,

1	domain.com/.htpasswd

I am prompted with a login box, asking for a user/password

When I browse the file-system as another user, I can not see .htpasswd. since the home directory is blocked from other users by FACLs, How are you gaining access to it or .htaccess without your user authorization, exactly? Please submit a support ticket with the exact URL.

(Jan 12 '11 at 19:43) johns ♦♦

Yes and No. If you have access to the repository in any form (as in, your own login) then you can use this method to see other people's usernames and perhaps find a hash collision to be able to submit commits masquerading as them. This is not a big vulnerability, but it's worth fixing.

nyellin is also correct about the privilege-escalation attack. Anonymous-read repositories expose the .htpasswd file directly; in essence, it would allow for someone to crack a commit password so that they could push to repositories that they should only be able to pull from.

We will now patch the installer.

(Jan 12 '11 at 21:31) ryans ♦♦

The installer patch has now been deployed. We will update the docs accordingly for anyone who already has an installed copy.

Thanks for your suggestion nyellin!

(Jan 12 '11 at 22:12) ryans ♦♦

Your answer

If you have an answer to the above question, then use the form below. Otherwise, use the appropriate 'add new comment' button above to post your feedback.

toggle preview

community wiki

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Tags:

git ×81
security ×42
.htpasswd ×4

Asked: Jan 11 '11 at 13:51

Seen: 1,881 times

Last updated: Jan 12 '11 at 22:12

Please Fix: Git Repositories Are Insecure By Default

Follow this question

Got questions? We have answers!

Related questions