{"vulnerability": "CVE-2021-39174", "sightings": [{"uuid": "6c3206f1-5e3e-49c1-9898-d2f3e44652b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39174", "type": "seen", "source": "https://t.me/arpsyndicate/2714", "content": "#ExploitObserverAlert\n\nCVE-2021-39174\n\nDESCRIPTION: Exploit Observer has 9 entries related to CVE-2021-39174. Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.\n\nFIRST-EPSS: 0.002440000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2024-01-09T05:31:33.000000Z"}, {"uuid": "9d0631d1-e347-47f9-b92c-22e2c7e0722b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39174", "type": "seen", "source": "https://t.me/cibsecurity/27981", "content": "\u203c CVE-2021-39174 \u203c\n\nCachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-28T07:28:56.000000Z"}, {"uuid": "0455d07e-d0ee-4651-a3c6-22b41e46626c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39174", "type": "seen", "source": "https://t.me/timcore_hacking/2059", "content": "#hackthebox\n#hacking\n\nHackTheBox - Catch\n\n01:00 - Start of nmap, going over some standard cookies and knowing the web technology behind it\n06:15 - Checking what the main webpage is, discovering an APK File\n07:00 - Analysing the APK file with JADX-GUI\n09:00 - Searching for strings, finding some tokens\n10:15 - Looking at the Gitea API to discover how to use our token\n14:15 - Looking at the Lets Chat API to discover how to use our token and dumping a list of rooms\n16:30 - Using the Lets Chat API to dump messages from a room and discovering credentials\n17:40 - Logging into the Catchet webserver finding the version and discovering known vulnerabilities\n19:20 - Using a CVE-2021-39174 POC to dump the Catchet Configuration and get a password (SSTI)\n23:50 - Logging into the box as will\n25:40 - Discovering a verify.sh script that has a command injection when verifying APK Files\n29:00 - Using apktool to decompile the APK so we can change the name and repackage it\n33:15 - Having trouble repacking our APK file, need to update APKTool. Then getting root\n38:00 - Showing another way to pop the Catchet server, by updating the Cache configuration to point to our REDIS instance and phpggc to create a deserialization gadget\n\nhttps://www.youtube.com/watch?v=XAZI361XgRU", "creation_timestamp": "2022-07-24T08:12:39.000000Z"}, {"uuid": "e38e0f5a-d7e9-4ef6-b409-e592bffd0e8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39174", "type": "published-proof-of-concept", "source": "https://t.me/timcore_hacking/2059", "content": "#hackthebox\n#hacking\n\nHackTheBox - Catch\n\n01:00 - Start of nmap, going over some standard cookies and knowing the web technology behind it\n06:15 - Checking what the main webpage is, discovering an APK File\n07:00 - Analysing the APK file with JADX-GUI\n09:00 - Searching for strings, finding some tokens\n10:15 - Looking at the Gitea API to discover how to use our token\n14:15 - Looking at the Lets Chat API to discover how to use our token and dumping a list of rooms\n16:30 - Using the Lets Chat API to dump messages from a room and discovering credentials\n17:40 - Logging into the Catchet webserver finding the version and discovering known vulnerabilities\n19:20 - Using a CVE-2021-39174 POC to dump the Catchet Configuration and get a password (SSTI)\n23:50 - Logging into the box as will\n25:40 - Discovering a verify.sh script that has a command injection when verifying APK Files\n29:00 - Using apktool to decompile the APK so we can change the name and repackage it\n33:15 - Having trouble repacking our APK file, need to update APKTool. Then getting root\n38:00 - Showing another way to pop the Catchet server, by updating the Cache configuration to point to our REDIS instance and phpggc to create a deserialization gadget\n\nhttps://www.youtube.com/watch?v=XAZI361XgRU", "creation_timestamp": "2022-07-24T08:12:39.000000Z"}]}