[GH-ISSUE #424] /data directory is exposed #248

New issue

Closed

opened 2026-03-03 01:27:12 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 01:27:12 +03:00

Owner

Originally created by @carlchan on GitHub (Mar 6, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/424

Looks like the default rocket config exposes the /data directory, allowing download of the db.sqlite3 password database. While everything in it is encrypted, that doesn't seem like a good idea.

reproduce via going directly to
https://bitwarden_rs.domain/data/db.sqlite3

Originally created by @carlchan on GitHub (Mar 6, 2019). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/424 Looks like the default rocket config exposes the /data directory, allowing download of the db.sqlite3 password database. While everything in it is encrypted, that doesn't seem like a good idea. reproduce via going directly to https://bitwarden_rs.domain/data/db.sqlite3

kerem

2026-03-03 01:27:12 +03:00

closed this issue
added the
troubleshooting
label

kerem commented

2026-03-03 01:27:13 +03:00

Author

Owner

@mprasil commented on GitHub (Mar 6, 2019):

There must be something else at play here. bitwarden_rs serves static files from web-vault sub-directory by default. I can't reproduce the issue personally, can you maybe provide some steps to reproduce?

@mprasil commented on GitHub (Mar 6, 2019): There must be something else at play here. `bitwarden_rs` serves static files from `web-vault` sub-directory by default. I can't reproduce the issue personally, can you maybe provide some steps to reproduce?

kerem commented

2026-03-03 01:27:13 +03:00

Author

Owner

@carlchan commented on GitHub (Mar 6, 2019):

Hmm. I just have a mostly default config, with web-vault enabled (instaleld using pre-compiled version)

here's the relevant log from cargo:

[2019-03-06 11:36:53][rocket::rocket][INFO] GET /data/db.sqlite3:
[2019-03-06 11:36:53][][INFO] Matched: GET /<p..> [10] (web_files)
[2019-03-06 11:36:53][][INFO] Outcome: Success
[2019-03-06 11:36:53][_][INFO] Response succeeded.

@carlchan commented on GitHub (Mar 6, 2019): Hmm. I just have a mostly default config, with web-vault enabled (instaleld using pre-compiled version) here's the relevant log from cargo: > [2019-03-06 11:36:53][rocket::rocket][INFO] GET /data/db.sqlite3: > [2019-03-06 11:36:53][_][INFO] Matched: GET /<p..> [10] (web_files) > [2019-03-06 11:36:53][_][INFO] Outcome: Success > [2019-03-06 11:36:53][_][INFO] Response succeeded.

kerem commented

2026-03-03 01:27:13 +03:00

Author

Owner

@mprasil commented on GitHub (Mar 6, 2019):

This is what I get when trying the same:

[2019-03-06 16:40:52][rocket::rocket][INFO] GET /data/db.sqlite3 text/html:
[2019-03-06 16:40:52][_][INFO] Matched: GET /<p..> [10] (web_files)
[2019-03-06 16:40:52][_][ERROR] Response was a non-`Responder` `Err`: Os { code: 2, kind: NotFound, message: "No such file or directory" }.

Do you have your data folder somewhere inside your web-vault folder by any chance?

@mprasil commented on GitHub (Mar 6, 2019): This is what I get when trying the same: ``` [2019-03-06 16:40:52][rocket::rocket][INFO] GET /data/db.sqlite3 text/html: [2019-03-06 16:40:52][_][INFO] Matched: GET /<p..> [10] (web_files) [2019-03-06 16:40:52][_][ERROR] Response was a non-`Responder` `Err`: Os { code: 2, kind: NotFound, message: "No such file or directory" }. ``` Do you have your data folder somewhere inside your `web-vault` folder by any chance?

kerem commented

2026-03-03 01:27:13 +03:00

Author

Owner

@carlchan commented on GitHub (Mar 6, 2019):

huh. you're right! how did that get there??

Yes that would be it, sorry, thank you.

@carlchan commented on GitHub (Mar 6, 2019): huh. you're right! how did that get there?? Yes that would be it, sorry, thank you.