Exposed .svn Directories

SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Exposed .svn Directories
For the last few years, we have been using subversion to manage our source code and move code live. One thing we overlooked was the fact that the .svn directories were exposed on our web server. Thanks to Ehraz and Umraz Ahmed ( #securityexe and #umrazahmed on twitter) for reporting this problem to us. As a solution, we made a couple of configuration changes: - prevented access to the directories via a "<Directory>" directive, - added respective rules to our web application firewall. ------ Johannes B. Ullrich, Ph.D. SANS Technology Institute Twitter I will be teaching next: Intrusion Detection In-Depth - SANS Baltimore Spring 2020	Johannes 3797 Posts ISC Handler
Subscribe	Dec 30th 2013 6 years ago
Hi, You shouldn't be doing SVN UP on your public webserver; you should be doing SVN EXPORT <revision #>. That will 'download' all the files, without all the .svn stuff. Bob	Anonymous
Quote	Dec 31st 2013 6 years ago