[Piuparts-devel] 📁 Directory Listing Enabled on https://piuparts.debian.org — Data Exposure Risk

[White Hat 71]

Severity: Medium
Bug Name: Directory Listing Enabled
Website: https://piuparts.debian.org
PoC URL: https://piuparts.debian.org/images/

Description:
Your web server allows directory listing, enabling anyone to browse contents of folders. This could expose sensitive files not meant for public viewing, such as backups, configs, or scripts.

Impact:
- Unintended file discovery.
- Easier path to LFI, RCE or other attacks.
- Exposes internal project structures or staging files.

Suggested Fix:
- Disable directory listing in your web server settings.
- Add `Options -Indexes` in `.htaccess` for Apache.
- Use custom 403 pages for unauthorized Browse.

White Hat Note:
Our goal is to make the internet safer through responsible testing and reporting. We are glad to help secure your site and hope it brings peace of mind. We would appreciate hearing about reward or acknowledgment you may offer.