Web server. SVN hidden folder exploits, fixes, and eliminates

Description

SVN (Subversion) is the source code version management software,

In the use of SVN,

A hidden folder named. SVN is automatically generated.

Contains important source code information.

If you copy the code folder directly to the Web server when you publish the code,

At the same time, SVN hidden folders are also uploaded to the program root directory,

You can use the. svn/entries file to obtain information such as server source code, SVN server account password, and so on.

One, this hidden folder is how to come?

When you get the release version from SVN, the SVN export feature is not used correctly!

Specific details, dark clouds above an article, you can refer to.

Second, how hackers use svn hidden file vulnerabilities?

1. Exploit tool: Seay svn exploit tool (please download yourself)

2, add site URL

Add/.svn/entries on the back of the URL being used

System Yun-wei www.osyunwei.com warm reminder: System operation of the original content © copyright, reproduced please indicate the source and the original link

Can be listed to the site directory, or even download the whole station.

Third, fix the loophole

1, add a section of code in the Web server configuration file, filter to the. svn file, and return 404

Nginx Server:

Location ~ ^ (. *) \/\.svn\/

{

return 404;

}

Restart Nginx

Apache Server:

<directory ~ "\.SVN" >

Order Allow,deny

Deny from all

</Directory>

Restart Apache

2. Find all. SVN hidden folders on the server, delete

The following command deletes the current directory. SVN folder

Find. -type d-name ". SVN" |xargs RM-RF

Rm-rf ' Find. -type d-name. SVN '

Find. -name ". SVN"-type D | Xargs RM-FR

Find. -name ". SVN"-type D | Xargs-n1 Rm-r

Using script deletion

#!/bin/sh

cd/home/web/

Find./-name ". SVN" |xargs-n1 echo >/dev/null 2>&1

Find./-name ". SVN"-print0 | xargs-0 RM-FR

If [$?-ne 0]; Then

echo "Remove. SVN dirs failed!"

Fi

The above file is saved as. sh

After execution, all. SVN hidden folders in the/home/web directory and its subdirectories are deleted.

Iv. elimination of such loopholes

When developers use SVN, the export functionality is strictly used. Direct copying of code is prohibited.