Published: 28/08/2021 Updated: 19/01/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 580

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Vulnerable Product	Search on Vulmon	Subscribe to Product
catchethq catchet

Cachet configuration leak dumper. CVE-2021-39174 PoC.

CVE-2021-39174-PoC Cachet configuration leak dumper CVE-2021-39174 PoC

CVE-2021-39174 Cachet 2.4.0-dev

CVE-2021-39174 Cachet 240-dev A python3 script for CVE-2021-39174 Cachet 240-dev Information Disclosure and RCE via Twig Server Side Template Injection For the RCE the API KEY for the user is needed Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection CVE-2021-39165 Getting Started Executing program Data Extraction python3 cachet_2

Hi! 👋 I'm some random 30-something human from the internet I thoroughly enjoy fucking with technology 🤷 🛠 Here's some stuff I've made: n0kovo_subdomainstxt – An extremely effective subdomain enumeration wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4

CWE-75 https://github.com/fiveai/Cachet/releases/tag/v2.5.1 https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688 https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/https://nvd.nist.gov https://github.com/narkopolo/CVE-2021-39174-PoC

CVE-2021-39174

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect