devtron-env-config-js: Devtron JavaScript Environment Configuration - Exposure

2026-04-16 devtron-env-config-js PoC Public

Description

Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings.

PoC

id: devtron-env-config-js

info:
  name: Devtron JavaScript Environment Configuration - Exposure
  author: johnk3r
  severity: low
  description: |
   Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings.
  reference:
    - https://github.com/devtron-labs/devtron
  metadata:
    verified: true
    max-request: 1
    vendor: devtron-labs
    product: devtron
    shodan-query: http.title:"Devtron"
    fofa-query: title="Devtron"
  tags: javascript,config,exposure,devtron

http:
  - method: GET
    path:
      - "{{BaseURL}}/dashboard/env-config.js"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "window._env_", "CENTRAL_API_ENDPOINT", "DEVTRON_APP_DETAILS_POLLING_INTERVAL")'
          - 'contains(content_type, "application/javascript")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220565f017b9128cd9d1929961a2d55da555553fc2c20393ba1375ae262307d7cb40221008ecc55baeaf618ac94843d1ab3b1d786d2a29b366fc5a77f4a4d78bae60726a7:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/devtron-env-config-js.yaml

References

Related Vulnerabilities