mirror of
https://github.com/myronblair/orbishosting
synced 2026-07-27 12:54:46 -05:00
myron
013b878b87
Live server audit found orbishosting.com/.git/config directly downloadable over HTTPS, exposing a plaintext GitHub PAT in the remote URL (docroot == git working directory, no deny rule existed). Also found the legacy SugarCRM install under public_html/legacy (gitignored, not part of this repo) publicly reachable via /legacy/index.php etc. Adds a docroot .htaccess (LiteSpeed honors rewrite-based deny rules per vhost.conf autoLoadHtaccess=1) to 403 all of these paths. This closes the HTTP exposure only — the leaked GitHub token itself still needs to be revoked/rotated on GitHub, this fix cannot do that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
658 B
ApacheConf
15 lines
658 B
ApacheConf
# Deny public access to the git working directory and legacy/unused
|
|
# server directories that live inside the web docroot but were never
|
|
# meant to be reachable over HTTP.
|
|
#
|
|
# Found during security review (2026-07): https://orbishosting.com/.git/config
|
|
# was directly downloadable and exposed a live GitHub PAT in the remote URL.
|
|
# That token must also be revoked/rotated on GitHub — this file only closes
|
|
# the HTTP exposure, it does not invalidate the leaked credential.
|
|
RewriteEngine On
|
|
RewriteRule ^\.git(/|$) - [F,L]
|
|
RewriteRule ^legacy(/|$) - [F,L]
|
|
RewriteRule ^dist(/|$) - [F,L]
|
|
RewriteRule ^extensions(/|$) - [F,L]
|
|
RewriteRule ^config(/|$) - [F,L]
|