# NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Azure App Service Local Git deployments placed .git in the public wwwroot; non-IIS stacks ignored the web.config mitigation, exposing source code to anyone fetching /.git.

- Payout: $7,500
- Severity: high
- Program: Microsoft
- Credited: Wiz
- Disclosed: 2021-12-21
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/azure-app-service-source-code-leak
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-azure-app-service-source-code-leak
- Tags: domain:cloud impact:data-leak kind:incident platform:threat-intel sev:high tech:azure technique:default-creds technique:recon vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Azure App Service *.azurewebsites.net web root (/home/site/wwwroot/.git)
**Root cause:** Local Git deployment initialized the repository inside the publicly served wwwroot; Microsoft's only protection was a web.config access rule, which Apache/Nginx/Flask-based PHP, Node, Ruby and Python stacks do not honor. An 'inplace deployment' state (file created via FTP/SSH/Web Deploy before Git deploy) also forced the repo into the public directory.
**Steps:**
1. Deploy a PHP/Node/Ruby/Python app to Azure App Service using Local Git (or create a file via FTP/SSH first, then Git deploy)
2. Request `GET https://<app>.azurewebsites.net/.git/config` and `/.git/HEAD`
3. Fetch `/.git/index` and objects, or run a git-dumper style tool to reconstruct the repository
4. Recover source code, developer emails, and any embedded secrets/tokens
**How found:** Wiz noticed that Local Git created the repo in the publicly accessible wwwroot and that Microsoft's web.config mitigation only applies to IIS; they reasoned non-IIS webservers would serve .git, then validated by deploying a vulnerable app linked to an unused domain and observing real scanning traffic.
**Exploitation:** Attacker scans azurewebsites.net subdomains for /.git paths and downloads the repository contents to extract source code and secrets; Wiz's honeypot app received .git requests from unknown actors within 4 days of deployment.
**Insight:** When a platform's security control is implemented in a stack-specific config file (web.config), check whether alternate runtimes on the same platform honor it; also test deployment-state transitions (pre-existing files forcing 'inplace' mode) that relocate sensitive artifacts into served directories.