Information Disclosure Due To exposed .env file (Directory Listing) at ████████
High
Vulnerability Details
A .env file was discovered on the server at ████, exposing sensitive application configurations, including database credentials, email settings, and more. This information could allow an attacker to gain unauthorized access to critical systems and services.
**Steps to Reproduce:**
1. Open a web browser.
2. Navigate to ████████.
3. The .env file content is displayed, revealing sensitive information.
**PoC Video Link:** ██████
## Impact
The exposed .env file could lead to multiple security threats, including but not limited to:
Unauthorized database access using DB_HOST, DB_USERNAME, and DB_PASSWORD.
Compromise of email services via MAIL_USERNAME and MAIL_PASSWORD.
Ability to access or manipulate other connected services.
Actions
View on HackerOneReport Stats
- Report ID: 2784712
- State: Closed
- Substate: informative
- Upvotes: 37