[34.96.80.155] Server Logs Disclosure lead to Information Leakage

Disclosed: 2021-12-09 16:52:23 By huntinex To evernote
Low
Vulnerability Details
## Summary: In this case server log is available for any in `/server-status` ## Steps To Reproduce: 1. Go to https://34.96.80.155/server-status/ and follow attack scenario's ### Attack Scenario's: **[Serg.io]** 1. User go to server and enter sensitive info that can be logged (example : `http://host/login?private_key=<KEY>`) 2. Attacker read the logs and founded sensitive information that user entered (example : `private_key=<KEY>`) {F1510839} **[translate.evernote.com]** In this site login and many features available and it's increase the impact 1. Users login with sso ( example : `/sso?sso_private_key=<key>&next=/ssoreturn` ) 2. Attacker can read full sso key and login (Account Take Over) ## Supporting Material/References: ### Why [34.96.80.155] blongs to www.evernote.com : * the ssl certificate : https://www.shodan.io/host/34.96.80.155 (SSL Cert related to *Evernote Corporation*) * copywrite section : > © 2014–2021 Evernote Corporation ## Impact attacker can read all log on server
Actions
View on HackerOne
Report Stats
  • Report ID: 1398270
  • State: Closed
  • Substate: resolved
  • Upvotes: 19
Share this report