myron/orbishosting
1
0
Fork 0
mirror of https://github.com/myronblair/orbishosting synced 2026-07-27 12:54:46 -05:00
Code Issues Packages Projects Releases Wiki Activity

security: block public access to .git, legacy, dist, extensions, config dirs

Browse Source 
Live server audit found orbishosting.com/.git/config directly downloadable
over HTTPS, exposing a plaintext GitHub PAT in the remote URL (docroot ==
git working directory, no deny rule existed). Also found the legacy
SugarCRM install under public_html/legacy (gitignored, not part of this
repo) publicly reachable via /legacy/index.php etc.

Adds a docroot .htaccess (LiteSpeed honors rewrite-based deny rules per
vhost.conf autoLoadHtaccess=1) to 403 all of these paths. This closes the
HTTP exposure only — the leaked GitHub token itself still needs to be
revoked/rotated on GitHub, this fix cannot do that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Myron Blair
2026-07-04 14:18:51 -05:00
parent 15bf427c2f
commit 013b878b87
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.htaccess
+14
View File
@@ -0,0 +1,14 @@
# Deny public access to the git working directory and legacy/unused
# server directories that live inside the web docroot but were never
# meant to be reachable over HTTP.
#
# Found during security review (2026-07): https://orbishosting.com/.git/config
# was directly downloadable and exposed a live GitHub PAT in the remote URL.
# That token must also be revoked/rotated on GitHub — this file only closes
# the HTTP exposure, it does not invalidate the leaked credential.
RewriteEngine On
RewriteRule ^\.git(/|$) - [F,L]
RewriteRule ^legacy(/|$) - [F,L]
RewriteRule ^dist(/|$) - [F,L]
RewriteRule ^extensions(/|$) - [F,L]
RewriteRule ^config(/|$) - [F,L]