Information Disclosure Due To exposed .env file (Directory Listing) at ████████

Disclosed: 2024-10-22 13:35:45 By necr0mancer To aws_vdp
High
Vulnerability Details
A .env file was discovered on the server at ████, exposing sensitive application configurations, including database credentials, email settings, and more. This information could allow an attacker to gain unauthorized access to critical systems and services. **Steps to Reproduce:** 1. Open a web browser. 2. Navigate to ████████. 3. The .env file content is displayed, revealing sensitive information. **PoC Video Link:** ██████ ## Impact The exposed .env file could lead to multiple security threats, including but not limited to: Unauthorized database access using DB_HOST, DB_USERNAME, and DB_PASSWORD. Compromise of email services via MAIL_USERNAME and MAIL_PASSWORD. Ability to access or manipulate other connected services.
Actions
View on HackerOne
Report Stats
  • Report ID: 2784712
  • State: Closed
  • Substate: informative
  • Upvotes: 37
Share this report