Template files accessible

[vtcdanh]

Expose information

Description

When I run the fusionauth server using the docker image and I access the following urls: /bin /lib /web /template /3rd-party-licenses...
The above urls cause the fusionauth server to go to another page
Especially when I access the path /template/fusionauth.properties or /bin/start.sh it will download that file, and it will reveal the password of the database. And path /lib show libary folder that potentially lets attacker know if we used a vulnerable library

Affects versions

1.40.0

Steps to reproduce

Steps to reproduce the behavior:

1. Start FusionAuth server with docker image
2. Go to http://localhost:9011/template/fusionauth.properties or http://localhost:9011/bin/start.sh
3. See error

Expected behavior

it will download a file fusionauth.properties.

Screenshots

Platform

(Please complete the following information)

• Device: Desktop
• OS: Window, Linux
• Browser + version : Chrome, Version 107.0.5304.88 (Official Build) (64-bit)
• Database: PostgresSQL version 12.9

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context