/data directory is exposed #247

New Issue

OVERLORD · 2026-02-04T18:57:10+03:00

OVERLORD commented

2026-02-04 18:57:10 +03:00

Originally created by @carlchan on GitHub (Mar 6, 2019).

Looks like the default rocket config exposes the /data directory, allowing download of the db.sqlite3 password database. While everything in it is encrypted, that doesn't seem like a good idea.

reproduce via going directly to
https://bitwarden_rs.domain/data/db.sqlite3

Originally created by @carlchan on GitHub (Mar 6, 2019). Looks like the default rocket config exposes the /data directory, allowing download of the db.sqlite3 password database. While everything in it is encrypted, that doesn't seem like a good idea. reproduce via going directly to https://bitwarden_rs.domain/data/db.sqlite3

OVERLORD added the troubleshooting label 2026-02-04 18:57:10 +03:00

OVERLORD closed this issue

2026-02-04 18:57:14 +03:00

OVERLORD commented

2026-02-04 18:57:19 +03:00

@mprasil commented on GitHub (Mar 6, 2019):

There must be something else at play here. bitwarden_rs serves static files from web-vault sub-directory by default. I can't reproduce the issue personally, can you maybe provide some steps to reproduce?

@mprasil commented on GitHub (Mar 6, 2019): There must be something else at play here. `bitwarden_rs` serves static files from `web-vault` sub-directory by default. I can't reproduce the issue personally, can you maybe provide some steps to reproduce?

OVERLORD commented

2026-02-04 18:57:38 +03:00

@carlchan commented on GitHub (Mar 6, 2019):

Hmm. I just have a mostly default config, with web-vault enabled (instaleld using pre-compiled version)

here's the relevant log from cargo:

[2019-03-06 11:36:53][rocket::rocket][INFO] GET /data/db.sqlite3:
[2019-03-06 11:36:53][][INFO] Matched: GET /<p..> [10] (web_files)
[2019-03-06 11:36:53][][INFO] Outcome: Success
[2019-03-06 11:36:53][_][INFO] Response succeeded.

@carlchan commented on GitHub (Mar 6, 2019): Hmm. I just have a mostly default config, with web-vault enabled (instaleld using pre-compiled version) here's the relevant log from cargo: > [2019-03-06 11:36:53][rocket::rocket][INFO] GET /data/db.sqlite3: > [2019-03-06 11:36:53][_][INFO] Matched: GET /<p..> [10] (web_files) > [2019-03-06 11:36:53][_][INFO] Outcome: Success > [2019-03-06 11:36:53][_][INFO] Response succeeded.

OVERLORD commented

2026-02-04 18:57:52 +03:00

@mprasil commented on GitHub (Mar 6, 2019):

This is what I get when trying the same:

[2019-03-06 16:40:52][rocket::rocket][INFO] GET /data/db.sqlite3 text/html:
[2019-03-06 16:40:52][_][INFO] Matched: GET /<p..> [10] (web_files)
[2019-03-06 16:40:52][_][ERROR] Response was a non-`Responder` `Err`: Os { code: 2, kind: NotFound, message: "No such file or directory" }.

Do you have your data folder somewhere inside your web-vault folder by any chance?

@mprasil commented on GitHub (Mar 6, 2019): This is what I get when trying the same: ``` [2019-03-06 16:40:52][rocket::rocket][INFO] GET /data/db.sqlite3 text/html: [2019-03-06 16:40:52][_][INFO] Matched: GET /<p..> [10] (web_files) [2019-03-06 16:40:52][_][ERROR] Response was a non-`Responder` `Err`: Os { code: 2, kind: NotFound, message: "No such file or directory" }. ``` Do you have your data folder somewhere inside your `web-vault` folder by any chance?

OVERLORD commented

2026-02-04 18:57:59 +03:00

@carlchan commented on GitHub (Mar 6, 2019):

huh. you're right! how did that get there??

Yes that would be it, sorry, thank you.

@carlchan commented on GitHub (Mar 6, 2019): huh. you're right! how did that get there?? Yes that would be it, sorry, thank you.

OVERLORD referenced this issue

2026-02-05 04:52:13 +03:00

[PR #258] [MERGED] Update backup section of README.md #2661

Sign in to join this conversation.