File Descriptor Leak in tsolucio/corebos

Valid

Reported on

Feb 27th 2022

Possible sensitive files

Vulnerability description: A possible sensitive file has been found. This file is not directly linked from the website. This check looks for common sensitive resources like password files, configuration files, log files, include files, statistics data, database dumps. Each one of these files could help an attacker to learn more about his target.

**.DS_Store .dccache /cache /test /Smarty/templates_c /storage /logs /backup /user_privileges /config-dev.inc.php /modules/Calendar4You/googlekeys /include/csrfmagic/csrf-secret.php /include/integrations/saml/certs /.vscode /.scannerwork /node_modules

poc url: https://demo.corebos.com/.gitignore

The impact of this vulnerability This file may expose sensitive information that could help a malicious user to prepare more advanced attacks.

How to fix this vulnerability Restrict access to this file or remove it from the website.

We are processing your report and will contact the tsolucio/corebos team within 24 hours. a year ago
We have contacted a member of the tsolucio/corebos team and are waiting to hear back a year ago
tharunavula
a year ago

Researcher

hi team,

is there any update.

regards, tharun

We have sent a follow up to the tsolucio/corebos team. We will try again in 7 days. a year ago
We have sent a second follow up to the tsolucio/corebos team. We will try again in 10 days. a year ago
Joe Bordes validated this vulnerability a year ago
tharunavula has been awarded the disclosure bounty
The fix bounty is now up for grabs
Joe Bordes marked this as fixed in 8.0 with commit ce58a1 a year ago
Joe Bordes has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation