exposed-gitmodules: .gitmodules File Exposed

2026-01-08 exposed gitmodules PoC Public

Description

The .gitmodules file was exposed on the web server as part of an accessible .git directory.This exposure indicated a misconfiguration that could have allowed attackers to explore the .git directory further and potentially reconstruct or download the full source code repository.

PoC

id: exposed-gitmodules

info:
  name: .gitmodules File Exposed
  author: pussycat0x
  severity: high
  description: |
    The .gitmodules file was exposed on the web server as part of an accessible .git directory.This exposure indicated a misconfiguration that could have allowed attackers to explore the .git directory further and potentially reconstruct or download the full source code repository.
  reference:
    - https://www.acunetix.com/vulnerabilities/web/git-repository-found/
    - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
  tags: exposure,git,source-disclosure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.gitmodules"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, '[submodule', 'path =', 'url =')"
        condition: and
# digest: 490a0046304402205623d9c27f0a90a201ad0bae20185f23e77dbe849e2e345abdbce467cce6c3fd02202cd61baaa1ad1cf6fb069487deb638d3cc75a429f0fadf91231c317a02f698d6:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/exposed-gitmodules.yaml

References

Related Vulnerabilities