medium

Stripe webhook signing secret exposed via .git directory

GET /.git/config

CVSS 6.5CWE-538category config

description

The application's deployment artifact includes a `.git/` directory, which is served by the production web server without restriction. The repository's `.git/config` exposes the remote URL, and pack-objects under `.git/objects/` allow full source recovery. We retrieved the project's `.env.production` file from the git history. It contains the Stripe webhook signing secret (`whsec_…`), the database password, and the JWT signing key. An attacker can use the webhook signing secret to forge payment webhooks and trigger arbitrary order fulfilment.

evidence

Request

GET /.git/config HTTP/1.1
Host: acme.dev

Response

HTTP/1.1 200 OK
Content-Type: text/plain

[core]
  repositoryformatversion = 0
  filemode = true
[remote "origin"]
  url = git@github.com:acme/acme-platform.git
[branch "main"]
  remote = origin
  merge = refs/heads/main

PoC

curl -s https://acme.dev/.git/config

Reconstruction of repo via `git-dumper` succeeded. `.env.production` recovered from commit history. Stripe secret redacted in this sample.

reproduction steps

Fetch https://acme.dev/.git/config. Observe a 200 response with the repo config.
Run `git-dumper https://acme.dev/.git/ ./acme-platform` to reconstruct the repository.
Search git history for environment files (`git log --all -- '.env*'`).
Recover the Stripe webhook signing secret from `.env.production` at commit 4a7c91e.
Forge a `checkout.session.completed` event signed with the recovered secret and POST it to /api/webhooks/stripe. Observe the order marked paid without payment.

remediation

Block the directory at the edge, strip `.git/` from the deploy artifact, and rotate every secret it exposed (Stripe webhook secret, DB password, JWT key) while invalidating active sessions. Fail CI if `.env*` or `.git/` ships.

nginx

location ~ /\.git { deny all; return 404; }

rotate the credentials you provided.

we ran the scan with the credentials you supplied. treat them as compromised and rotate now.

couldn't reproduce this finding?

if it does not reproduce from the evidence above, you get back what this finding cost you: its credits for a credit unlock, or a cash refund for a finding bought through our earlier per-finding checkout. see how claims work, or email team@recon.sh with finding ID f4 and scan ID sample.