Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

piwik.org - open directoryy listing vulnerability #3588

Closed
anonymous-matomo-user opened this issue Dec 3, 2012 · 2 comments
Closed

piwik.org - open directoryy listing vulnerability #3588

anonymous-matomo-user opened this issue Dec 3, 2012 · 2 comments
Labels
Bug For errors / faults / flaws / inconsistencies etc. c: Website matomo.org For issues related to our matomo.org website. Major Indicates the severity or impact or benefit of an issue is much higher than normal but not critical. worksforme The issue cannot be reproduced and things work as intended.

Comments

@anonymous-matomo-user
Copy link

By this vulnerability any attacker could view all files in a given web directory. This allows them to see files which might not be linked anywhere on your site, including files which may include sensitive information, such as backup script files (like index.php~ or index.php.bak), htaccess files, or text files with notes (password.txt!) &here in this website also we can access the htacess files and logs .
The other method is more dangerous. Some web servers are setup such that the web home is actually the user home, so passing in certain values in the web address can allow directory listings outside of the normally safe web folder structure. This is more dangerous since an attacker may be able to find and execute programs on your server through a web browser, potentially exploiting those programs as well.

Effected links:-
1.) http://piwik.org/wp-content/plugins/sitepress-multilingual-cms/
2.) http://piwik.org/wp-content/plugins/sitepress-multilingual-cms/res/
3.) http://piwik.org/wp-content/plugins/sitepress-multilingual-cms/res/css/
Security Risk :- If one or more directories holds a secret file, such as a password or key file, the attackers may be able to steal it. Additionally, directory traversal can sometimes allow attackers to access files outside the web root directory, leading to the stealing of system files, which can aid in other, additional attacks.
I hope this vulnerabilitiy will be patched as soon as possible.

@mattab
Copy link
Member

mattab commented Dec 13, 2012

Thanks for the report, this is now fixed!

@robocoder
Copy link
Contributor

Clarification that this was a web server configuration issue with our Wordpress installation, and not a vulnerability in the Piwik software.

@anonymous-matomo-user anonymous-matomo-user added this to the Official Piwik Plugins Repository project milestone Jul 8, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug For errors / faults / flaws / inconsistencies etc. c: Website matomo.org For issues related to our matomo.org website. Major Indicates the severity or impact or benefit of an issue is much higher than normal but not critical. worksforme The issue cannot be reproduced and things work as intended.
Projects
None yet
Development

No branches or pull requests

3 participants