Found a url on source code which was disclosing different juicy informations like ip addresses and available endponts
None
S
Sifchain
Submitted None
Actions:
Reported by
paranoid07
Vulnerability Details
Technical details and impact analysis
## Summary:
I found a link in " https://github.com/Sifchain/sifnode/blob/develop/deploy/rake/cluster.rake" page which was exposing ip adresses and different endpoints which could be missused by hackers.
Link Is=https://rpc.sifchain.finance/
## Steps To Reproduce:
1. Visit https://rpc.sifchain.finance/
## Supporting Material/References:
{F1299908}
Sample:
found on https://rpc.sifchain.finance/net_info?
"remote_ip": "52.215.172.88"
},
{
"node_info": {
"protocol_version": {
"p2p": "7",
"block": "10",
"app": "0"
},
"id": "5a03d7636ad9899e6ffb06ec929cdb9c963d5d3d",
"listen_addr": "46.137.53.38:26656",
"network": "sifchain",
"version": "0.33.9",
"channels": "4020212223303800",
"moniker": "sarah",
"other": {
"tx_index": "on",
"rpc_address": "tcp://0.0.0.0:26657"
}
},
## Impact
Internal Ip adresses , endpoints and other sensitive info related to company are revealed which can be used by attacker for Bad purpose.Attacker can use those endpoints for further attack
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Information Exposure Through Directory Listing