Information Disclosure Due To exposed .env file (Directory Listing) at ████████
High
A
AWS VDP
Submitted None
Actions:
Reported by
necr0mancer
Vulnerability Details
Technical details and impact analysis
A .env file was discovered on the server at ████, exposing sensitive application configurations, including database credentials, email settings, and more. This information could allow an attacker to gain unauthorized access to critical systems and services.
**Steps to Reproduce:**
1. Open a web browser.
2. Navigate to ████████.
3. The .env file content is displayed, revealing sensitive information.
**PoC Video Link:** ██████
## Impact
The exposed .env file could lead to multiple security threats, including but not limited to:
Unauthorized database access using DB_HOST, DB_USERNAME, and DB_PASSWORD.
Compromise of email services via MAIL_USERNAME and MAIL_PASSWORD.
Ability to access or manipulate other connected services.
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Information Exposure Through Directory Listing