当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0121319

漏洞标题：PHP官方多个分站存在git信息泄露可读取大量程序源码

相关厂商：PHP

漏洞作者： 渔村安全实验室

提交时间：2015-06-18 11:00

修复时间：2015-06-23 11:02

公开时间：2015-06-23 11:02

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-18： 细节已通知厂商并且等待厂商处理中
2015-06-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

PHP官方多个分站存在git信息泄露可读取大量程序源码

详细说明：

GIT打包

http://preview.php.net/.git/config
http://hk.php.net/.git/config
http://shared.php.net/.git/config
http://br.php.net/.git/config
http://br1.php.net/.git/config
http://br2.php.net/.git/config
http://master.php.net/.git/config
http://master.php.net/.git/config
http://mail.php.net/.git/config
http://qa.php.net/.git/config
http://qa.php.net/.git/config
http://nc.php.net/.git/config
http://nc1.php.net/.git/config
http://bd.php.net/.git/config
http://bd1.php.net/.git/config
http://tw2.php.net/.git/config
http://mx.php.net/.git/config
http://lxr.php.net/.git/config
http://hk2.php.net/.git/config
http://mx1.php.net/.git/config
http://at1.php.net/.git/config
http://ua2.php.net/.git/config
http://ua.php.net/.git/config
http://pt2.php.net/.git/config
http://dk.php.net/.git/config
http://dk1.php.net/.git/config
http://id.php.net/.git/config
http://id1.php.net/.git/config
http://th.php.net/.git/config
http://jm2.php.net/.git/config
http://jm.php.net/.git/config
http://de.php.net/.git/config
http://de1.php.net/.git/config
http://se2.php.net/.git/config
http://is.php.net/.git/config
http://ca.php.net/.git/config
http://li.php.net/.git/config
http://pl1.php.net/.git/config
http://pl.php.net/.git/config
http://jp2.php.net/.git/config
http://ca1.php.net/.git/config
http://us2.php.net/.git/config
http://ca2.php.net/.git/config
http://es.php.net/.git/config
http://es1.php.net/.git/config
http://se.php.net/.git/config
http://it1.php.net/.git/config
http://is2.php.net/.git/config
http://bg.php.net/.git/config
http://bg2.php.net/.git/config
http://docs.php.net/.git/config
http://euk2.php.net/.git/config
http://md1.php.net/.git/config


案例：http://preview.php.net/.git/config

2015-06-18_100634.png


2015-06-18_100903.png


2015-06-18_100931.png


漏洞证明：

修复方案：

版权声明：转载请注明来源 渔村安全实验室@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-06-23 11:02

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无