File Descriptor Leak in tsolucio/corebos

Valid

Reported on

Feb 27th 2022


Possible sensitive files

Vulnerability description: A possible sensitive file has been found. This file is not directly linked from the website. This check looks for common sensitive resources like password files, configuration files, log files, include files, statistics data, database dumps. Each one of these files could help an attacker to learn more about his target.

**.DS_Store .dccache /cache /test /Smarty/templates_c /storage /logs /backup /user_privileges /config-dev.inc.php /modules/Calendar4You/googlekeys /include/csrfmagic/csrf-secret.php /include/integrations/saml/certs /.vscode /.scannerwork /node_modules

poc url: https://demo.corebos.com/.gitignore

The impact of this vulnerability This file may expose sensitive information that could help a malicious user to prepare more advanced attacks.

How to fix this vulnerability Restrict access to this file or remove it from the website.

We are processing your report and will contact the tsolucio/corebos team within 24 hours. 3 months ago
We have contacted a member of the tsolucio/corebos team and are waiting to hear back 3 months ago
tharunavula
3 months ago

Researcher


hi team,

is there any update.

regards, tharun

We have sent a follow up to the tsolucio/corebos team. We will try again in 7 days. 3 months ago
We have sent a second follow up to the tsolucio/corebos team. We will try again in 10 days. 3 months ago
Joe Bordes validated this vulnerability 2 months ago
tharunavula has been awarded the disclosure bounty
The fix bounty is now up for grabs
Joe Bordes confirmed that a fix has been merged on ce58a1 2 months ago
Joe Bordes has been awarded the fix bounty
to join this conversation