FirstBlood-#760 — Multiple server config files are accessable publicly.
This issue was discovered on FirstBlood v2

On 2021-10-28, vishal Level 2 reported:

Discription: multiple server configuration files are accessable to anyone.

Steps to Reproduce:
  1. visit /.gitattributes
  2. visit /.gitignore
  3. visit /composer.json
  4. visit /composer.lock
  5. visit /composer.phar

Impact : these are all either server files or config pages which are supposed to be kept private . information contained in these files could be used for further escilate attack by attacker like .composer.json reveal monolog version which is vulnerable to RCE.

Lastly let me know if anything missing or required - Vishal

P2 High

Endpoint: /.gitattributes /.gitignore /composer.json /composer.lock /composer.phar

Parameter: none

Payload: none

FirstBlood ID: 36
Vulnerability Type: Information leak/disclosure

It is possible to use the composer.json to aid with another vulnerability and gaining information/knowledge on versions used.