Full Path Disclosure
Severity: Medium Discovered: 10 of October-2022, 11:11 PM
CWE ID
CWE-200
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
Full Path Disclosure (FPD) vulnerabilities enable an attacker to see the path to a webroot/file.
Certain vulnerabilities require the attacker to get the full path to the file that they wish to view.
For example, when using a load_file() query (within a SQL Injection) to view the page source.
Detected webroot/file is:
• /var/www/
Detected system is:
• linux
Found in URL:
• https://brokencrystals.com/api/render
Detected that a new fake cookie(s) was added with the same name, but with a different value appended to the end of the cookie(s):
Original cookie:
• bc-calls-counter=1665443512838; connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc
New cookie:
• bc-calls-counter=1665443512838; connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc; bc-calls-counter=.
Cookie that is added:
• bc-calls-counter=.
Cookie key is:
• bc-calls-counter
Token is:
• .
Possible exposure
Read Application Data, Access to Privileged Information
Remediation suggestions
To fix this vulnerability –
• Disable debug information in the web server’s configuration.
• Improve the error handling and parsing of cookies in the relevant code paths, so that exceptions and/or errors will not leak internal information.
Request
POST https://brokencrystals.com/api/render HTTP/1.1
Accept: application/json, text/plain, */*
Referer: https://brokencrystals.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Content-Type: text/plain
Cookie: bc-calls-counter=1665443512838; connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc; bc-calls-counter=.
Accept-Encoding: identity
Content-Length: 0
Response
HTTP/1.1 500
Server: nginx/1.19.8
Date: Mon, 10 Oct 2022 23:11:54 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 107
Connection: keep-alive
vary: Origin
access-control-allow-origin: *
set-cookie: connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc; Path=/
Cache-Control: public, max-age=99999
{"error":"Invalid counter value","location":"/var/www/dist/components/headers.configurator.interceptor.js"}External links
Full Path Disclosure
Severity:
MediumDiscovered:10 of October-2022, 11:11 PMCWE ID
CWE-200
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
Full Path Disclosure (FPD) vulnerabilities enable an attacker to see the path to a webroot/file.
Certain vulnerabilities require the attacker to get the full path to the file that they wish to view.
For example, when using a load_file() query (within a SQL Injection) to view the page source.
Detected webroot/file is:
• /var/www/
Detected system is:
• linux
Found in URL:
• https://brokencrystals.com/api/render
Detected that a new fake cookie(s) was added with the same name, but with a different value appended to the end of the cookie(s):
Original cookie:
• bc-calls-counter=1665443512838; connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc
New cookie:
• bc-calls-counter=1665443512838; connect.sid=DIhv0SOkovfohTbyblj4n1nEYyqUh8CE.RJDj06LhVCMDwkPsnPTONG%2B5d2et3DRzZ0Ji%2BRnKdvc; bc-calls-counter=.
Cookie that is added:
• bc-calls-counter=.
Cookie key is:
• bc-calls-counter
Token is:
• .
Possible exposure
Read Application Data, Access to Privileged Information
Remediation suggestions
To fix this vulnerability –
• Disable debug information in the web server’s configuration.
• Improve the error handling and parsing of cookies in the relevant code paths, so that exceptions and/or errors will not leak internal information.
Request
Response
External links