back
270 comments
So basically you run an endless script to fetch https://www.tesla.com/sites/default/settings.php and hope that some day there will be a minor nginx config error which lets you download the php source instead of executing it.

This will happen some day, so invest 5 bucks per month to exploit Tesla at a certain point, so maybe you can be first in line for the Cybertruck :-)

This seems to be a too sophisticated attack, sometimes simplicity is better: https://samcurry.net/cracking-my-windshield-and-earning-1000...
Pretty sure every site on IPv4 gets probed multiple times a day for common config leaks and other misconfigurations. Happens to all of mine.
This comment transported me back to 2010 or thereabouts when this happened to Facebook. I remember being surprised at the simplicity of the code and making a lot of jokes about "build a facebook clone" ads on freelance websites.
I am sure there are lots of automated scripts doing precisely that with pretty much every company that has a website.

I used to keep a hall of shame on my main site, because looking for "settings.php" or "global.asa" on a Zope site was just silly.

Except that you'll find that error long before the cybertruck ships. Heck, you'll probably see the rebirth of NFTs and BTC over US$40000 before the cybertruck ships.
Interesting, the exclude file (actually, everything under .git/info) 403s, while .git/index is a 404.

- https://www.tesla.com/.git/info/exclude

- https://www.tesla.com/.git/index

README.txt 403s too. https://www.tesla.com/README.txt

edit: just going to add files I've found here:

- https://www.tesla.com/.editorconfig

- https://www.tesla.com/profiles/README.txt

https://cdn-design.tesla.com/.git/ this url says 'No.'
There's also https://www.tesla.com/phpunit.xml
Two space tabs, nice.
Add a trailing slash to index and it 403s
A companies marketing website and their actual products have little in common. I would be surprised if any engineers even work on the marketing website and blown away if it is co-located with something sensitive.
If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt
I found a bug in the tesla model 3 reservation system that allowed anyone to get a reservation for free. Reported it via hackerone (or maybe it was bugcrowd dont remember) and got told it was of no consequence and would be filtered out later or something. Got no bounty for hours of work.

I accidentally ordered my model 3 with a free reservation, not the one I actually paid for.

So, should we just add .gitignore to .gitignore and problem solved ?
I like the simplicity and pragmatism of using drupal. I wouldn’t work with it myself but it was probably the cheapest/fastest way to get a similar site up and running
Can someone explain why this is leaky and how it can be exploited by malicious actors?
Ask myself what other files will be exposed?
There is a `cron.php` lol
> sites//settings.php

Yes PHP is still relevant!

Potentially also of interest is robots.txt. Who knew Tesla had ontologists?

https://www.tesla.com/robots.txt

Disallow: /taxonomy/term/*

404: https://www.tesla.com/taxonomy/term/

It looks like https://www.tesla.com/INSTALL.txt & https://www.tesla.com/README.txt exist, but aren't accessible.
Some Tesla holiday on-call devops or security person is probably getting paged over this right now.
Can’t access it…
I think a lot of people in here are overreacting a bit. This is an interesting curiosity that doesn't really have any baring on any of Tesla's internal software.
It's just their landing page, but still embarrassing nonetheless.
It’s not leaky at all.
“Hardcore Engineering”
Seems they took it offline. Any mirrors?
The Venn diagram of people who had an issue with the Tesla website yesterday, and people laughing at it being Drupal today does not intersect.
One of the best technology companies (let's assume it's) cannot maintain its site with modern technology. How can I trust them?
Getting a 403 Forbidden error.
Huh... php
Getting 403 Forbidden now
universal galactic extreme programming requires it
They've got something a bit more fucked up than just an exposed .gitignore

    $ curl -si https://www.tesla.com/ | grep generator
    x-generator: Drupal 9 (https://www.drupal.org)

    $ curl -si https://www.tesla.com/authorize.php | grep generator
    x-generator: Drupal 7 (http://drupal.org)
So they have at least two versions running at the same time. The /authorize.php [1] uri also yields a 500 (instead of a 403 like most of the other resources), which implies Apache is most likely passing the request off to PHP and the script has a fatal or unhandled error.

The webroot appears to be a Drupal 7.x installation and Apache is serving that content directly (e.g. https://www.tesla.com/MAINTAINERS.txt same as [2]) and trying to run some of it (authorize.php), while happy-path requests are being reverse-proxied to a Drupal 9.x installation.

[1] https://github.com/drupal/drupal/blob/7.x/authorize.php

[2] https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt

Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any way to their software engineering team.

Usually these marketing sites are running a CMS (this one looks like Drupal) which is owned and operated by either an internal team who report to the CIO / IT department (vs the Product/Engineering group) or a totally external third-party marketing firm.

As long as the "real" product uses different subdomains, certificates, proper HSTS, cross-origin protection, and secure cookies (a tall order, yes, but something that would be an issue no matter what the marketing site is doing), security issues in the "marketing" site aren't as bad. Of course a marketing site takeover is still worrying, as it's a prime entry point for spearphishing and horizontal movement through social engineering, but these usually aren't the same engineers or security team at all.

I think this site's code repository needs to be reviewed. Maybe should call some twitter engineers
Check this: https://cdn-design.tesla.com/tds-fonts/

Saved version:

TypeError: Cannot read property '0' of null

    at forceFontAssetSource (/app/routes/middleware/moduleVersion.js:89:32)
    at Layer.handle [as handle_request] (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:317:13)
    at /app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:335:12)
    at next (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:275:10)
    at cors (/app/node_modules/cors/lib/index.js:188:7)
    at /app/node_modules/cors/lib/index.js:224:17
    at originCallback (/app/node_modules/cors/lib/index.js:214:15)
    at /app/node_modules/cors/lib/index.js:219:13
https://www.tesla.com/LICENSE.txt Tesla opensource confirmed?
So Tesla is free software: https://www.tesla.com/LICENSE.txt
You all are cringe. Anyone working in tech knows that most marketing sites are made by third parties, likely some WordPress shop. The hatred for Elon on this site is ridiculous.
My dear American friends. What if this is a psyop from tesla marketing to get your attention?
Good thing these are the people who helped fire Twitter's security team. Sure that's going to work out great.
At least https://www.tesla.com/.git/config is not accessible but still. This should never happen to a company that considers itself a software company first and a car company second.