Important files leaking on firstblood

FirstBlood-#588 — Important files leaking on firstblood
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-26, newrouge Level 3 reported:


        Hey, i found that their are many important files leaking from server which should be generally 403 forbidden normal users. It's a server misconfiguration.
Steps:

Composer files are leaking from server.


visit https://1b42ba552850-newrouge.a.firstbloodhackers.com/composer.json

    "require": {
        "monolog/monolog": "2.1.1"
    }
}

visit https://1b42ba552850-newrouge.a.firstbloodhackers.com/composer.phar ,  leaks server php archive files.



visit https://1b42ba552850-newrouge.a.firstbloodhackers.com/composer.lock 
leaks libraries used.



Visit https://1b42ba552850-newrouge.a.firstbloodhackers.com/.gitignore  and 
Visit https://1b42ba552850-newrouge.a.firstbloodhackers.com/.gitattributes files leaking

These files should not be exposed to everyone. 
Thank you
newrouge

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: N/A

Parameter: N/A

Payload: N/A

FirstBlood ID: 36
Vulnerability Type: Information leak/disclosure

It is possible to use the composer.json to aid with another vulnerability and gaining information/knowledge on versions used.

BugBountyHunter

Steps: