Phinx is an open-source PHP software designed to help developers to quickly create and maintain their SQL databases migrations through PHP code. Phinx uses a configuration file in the project root directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

A European Personal Data Number (EPDN) is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN located within the response of the affected page

The web server on the remote host allows read access to a Mercurial repository metadata directory. This access may be abused to access content from the web server that might otherwise be private.

ASP.NET Core applications can read configuration data based on key-value pairs from multiple providers and sources. By using the JSON configuration provider, data can be retrieved from predictable configuration files named `appsettings.json` and `appSettings.{Environment}.json`.

Developers sometimes store secrets or other sensitive information in these configuration files. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

The web server on the remote host contains publicly accessible Wget listing files. These listing files are produced by Wget during ftp transfers and contain details of source/destination file names, permissions, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

SQL files have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality covering amongst others remote file access, credentials and launch configurations. Configurations may be located inside a hidden directory named .vscode. When exposed with the web application configuration, these configuration files may expose sensitive information which may be used by an attacker to gain unauthorized access.

Docker Compose is a tool designed to help developers defining and running multi-container Docker applications. By defining a configuration file named `docker-compose.yml` in their application project directory, developers can define the different services used by the application with their configurations.

By accessing an exposed `docker-compose.yml` file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

HashiCorp Vagrant is an open-source software designed to help developers building and maintaining portable virtual software development environments. By defining a file named `Vagrantfile`, developers can describe the configuration of these environments and how to provision them.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Cloud Build is Google Cloud continuous integration and deployment serverless platform used to build and test software projects. By defining a configuration file named `cloudbuild.yaml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Programming languages are often used along with package management tools designed to help developers manages the code dependencies when building their web applications (for example : Composer for PHP, NPM for NodeJS, PIP for Python...). These tools usually work by requesting public code repositories in order to fetch the dependencies and help installing and using specific versions in the project.

When package configuration files are exposed, an attacker could use it to infer the software components used in the target application and to try conduct further attacks.

Travis CI is a Software as a Service (SaaS) based continuous integration service used to build and test software projects. By defining a configuration file named `.travis.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

CircleCI is a continuous integration service available as a Software as a Service (SaaS) based application or as a private instance and which is used to build and test software projects. By defining a configuration file named `.circleci/config.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

GitLab is a popular Git-based Source Code Management system (SCM) provided by GitLab Inc. as both a cloud and an on-premise service. GitLab has Continuous Integration and Continuous Development (CI/CD) capabilities offering automatic builds, tests and deployments through a configuration file named `.gitlab-ci.yml`.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Bitbucket is a popular Git-based Source Code Management system (SCM) provided by Atlassian as both a cloud and an on-premise service. Bitbucket Pipelines is an integrated Continuous Integration and Continuous Development (CI/CD) feature of Bitbucket, offering automatic builds, tests and deployments through a configuration file named `bitbucket-pipelines.yml`.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Jenkins is a popular open source automation software used to help building, testing and deploying software. Jenkins Pipeline is a collection of plugins allowing developers to implement and integrate continuous delivery (CD) into Jenkins, by defining a `Jenkinsfile` file and adding it to their source control manager (SCM). When exposed, this file can be used by an attacker to gain access to sensitive information.

Azure Functions is a public cloud service from Microsoft providing a serverless computing platform which supports various programming languages (C#, Python, JavaScript...).

Before deploying their functions to the cloud, developers often write and test their code in their local development environment. Azure development tools use settings and sometimes secrets variables stored in a file named `local.settings.json`, which, when exposed, can be used by an attacker to gain access to sensitive information.

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) feature provided by Amazon Web Services which allows developers to quickly deploy their web applications in various predefined environments (Java, .NET, PHP...) without managing the underlying infrastructure configuration. AWS Elastic Beanstalk also allows the deployment of Docker images based applications by using a specific JSON file named `Dockerrun.aws.json` which, when exposed, can be used by an attacker to gain access to sensitive information.

Google APIs support the OAuth 2.0 protocol for authentication and authorization in different deployment scenarios. In order to gain access to Google APIs and in some scenarios, the client application has to authenticate itself against the Google authorization servers by using credentials such as a client ID and a client secret and then retrieve a valid access token.

In the context of web server applications, the OAuth 2.0 secret used to retrieve the token is sensitive and, if leaked with the client ID, can lead to an attacker impersonating the vulnerable application and performing arbitrary requests against Google APIs.

Docker is one of the most popular platform using virtualization at the operating system level to deliver software in packages called containers. To take advantage of cloud based infrastructures, developers often build their applications on top of the microservices architecture pattern with one or multiple Docker containers, helping them to quickly build and deploy it to various environments.

Docker containers are based on a `Dockerfile` file describing the different steps to build the application and containing sometimes hardcoded secrets or other sensitive information. By accessing an exposed `Dockerfile`, an attacker could leverage the vulnerability to gain unauthorized access to one or multiple web application components.

The web server on the remote host contains publicly accessible FTP configuration files. These configuration files are produced by ftp software and contain details of ftp credentials and/or hosts and other potentially sensitive information. This may be used to access content from the FTP server that might otherwise be private.

Apache Log4j is an open source Java-based logging framework leveraged within numerous Java applications. The scanner detected the presence of installation files referring to the usage of Apache Log4j.

WordPress Duplicator Plugin files have been detected on the target WordPress installation.

This may present an attacker with sensitive information to mount further attacks.

WordPress Plugins sensitive files have been detected on the target WordPress installation.

This may present an attacker with sensitive information to mount further attacks, such as keys, credentials, internal host names, database tables & SQL queries, security logs, full path disclosures, filenames, software versions and other sensitive information.

ELMAH (Error Logging Modules and Handlers) is an application error logging facility. This application is not properly configured and leads to information disclosure via elmah.axd or errorlog.axd. This allows an unauthenticated, remote attacker to view web requests made to the server, including sensitive information like Session ID values, full path or request variables.

Scanner has detected server-side source code within the server's response.

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server side code should be executed by the server, it should never be seen by the client, however in some scenarios it is possible that the server has a misconfiguration or the server side code has syntax errors, and therefore is not executed by the server but is instead sent to the client. As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

The web server on the remote host allows read access to files within a 'CVSROOT' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private & permit download of the source code of listed pages hosted on the remote server.

The web server on the remote host allows read access to files within a 'CVS' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private.

The web server on the remote host allows read access to files within a '.svn' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private & permit download of the source code of listed pages hosted on the remote server.

The web server on the remote host allows read access to a OSX .DS_Store file. This potential flaw can be used to access content from the web server that might otherwise be private.

The US Social Security Number (SSN) is a personally identifiable number that is issued to its citizens. A stolen or leaked SSN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an SSN located within the response of the affected page

The web server on the remote host contains publically accessible WS_FTP log files. These log files are produced by WS_FTP and contain details of source/destination file names, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

An error or warning message has been found on the remote web server. It may be possible for an attacker to view sensitive information and conduct further attacks.

The web server on the remote host contains gitignore configuration files. This potential flaw can be used to access content from the web server that might otherwise be private.

An information disclosure vulnerability exists in the remote web server due to the disclosure of the web.config file. An unauthenticated, remote attacker can exploit this, via a simple GET request, to disclose potentially sensitive configuration information.

The web server on the remote host allows read access to a Git repository. This potential flaw can be used to access content from the web server that might otherwise be private.

The remote web server contains an application which is affected by a path disclosure issue. It may be possible for an attacker to view full path names and conduct further attacks.

Credit card numbers are used in applications where a user is able to purchase goods and/or services.

A credit card number is a sensitive piece of information and should be handled as such. Cyber-criminals will use various methods to attempt to compromise credit card information that can then be used for fraudulent purposes.

Through the use of regular expressions and CC number format validation using known issuer numbers and luhn check validation, the scanner was able to discover a credit card number located within the affected page.

Scanner has detected server-side source code within the server's response.

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server side code should be executed by the server, it should never be seen by the client, however in some scenarios, using crafted requests it is possible to force the server into displaying the source code of the application without executing it. As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

Concurrent Version System (CVS) and Subversion (SVN) provide a method for application developers to control different versions of their code.

Occasionally, the developer's version or user information can be stored incorrectly within the code and may be visible to the end user (either in the HTML or code comments). As one of the initial steps in information gathering, cyber-criminals will spider a website and using automated methods attempt to discover any CVS/SVN information that may be present in the page.

This will aid them in developing a better understanding of the deployed application (potentially through the disclosure of version information), or it may assist in further information gathering or social engineering attacks.

Using the same automated methods, scanner was able to detect CVS or SVN details stored within the affected page.

Email addresses are typically found on "Contact us" pages, however, they can also be found within scripts or code comments of the application. They are used to provide a legitimate means of contacting an organisation.

As one of the initial steps in information gathering, cyber-criminals will spider a website and using automated methods collect as many email addresses as possible, that they may then use in a social engineering attack.

Using the same automated methods, scanner was able to detect one or more email addresses that were stored within the affected page.

Private, or non-routable, IP addresses are generally used within a home or company network and are typically unknown to anyone outside of that network.

Cyber-criminals will attempt to identify the private IP address range being used by their victim, to aid in collecting further information that could then lead to a possible compromise.

Scanner discovered that the affected page returned a RFC 1918 compliant private IP address and therefore could be revealing sensitive information.

This finding typically requires manual verification to ensure the context is correct, as any private IP address within the HTML body will trigger it.

A common practice when administering web applications is to create a copy/backup of a particular file or directory prior to making any modification to the file. Another common practice is to add an extension or change the name of the original file to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`, etc.).

During the initial recon stages of an attack, cyber-criminals will attempt to locate backup files by adding common extensions onto files already discovered on the webserver. By analysing the response headers from the server they are able to determine if the backup file exists. These backup files can then assist in the compromise of the web application.

By utilising the same method, the scanner was able to discover a possible backup file.

A common practice when administering web applications is to create a copy/backup of a particular directory prior to making any modification. Another common practice is to add an extension or change the name of the original directory to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`, etc.).

During the initial recon stages of an attack, cyber-criminals will attempt to locate backup directories by adding common extensions onto directories already discovered on the webserver. By analysing the response headers from the server they are able to determine if a backup directory exists. These backup directories can then assist in the compromise of the web application.

By utilising the same method, scanner was able to discover a possible backup directory.

ID	Name	Severity
113433	Phinx Configuration File Detected	medium
113430	Disclosed European Personal Data Number	medium
113372	Mercurial Repository Detected	medium
113228	ASP.NET Core Configuration File Detected	medium
113227	Wget Listing File Detected	medium
113213	SQL File Detected	medium
113201	Visual Studio Code Configuration Detected	medium
113168	Docker Compose Configuration Detected	medium
113167	HashiCorp Vagrant Configuration Detected	medium
113166	Google Cloud Build Configuration Detected	medium
113158	Package Dependencies Detected	medium
113156	Travis CI Configuration Detected	medium
113157	CircleCI Configuration Detected	medium
113142	GitLab CI Configuration Detected	medium
113141	Atlassian Bitbucket Pipelines Configuration Detected	medium
113140	Jenkinsfile Detected	medium
113139	Azure Functions Local Settings Detected	medium
113125	AWS Elastic Beanstalk Dockerrun Detected	medium
113124	Google API OAuth Credentials Detected	high
113123	Dockerfile Detected	medium
113080	FTP Credentials Disclosure	medium
113076	Apache Log4j Installation File Detected	high
112721	Duplicator Plugin for WordPress Installation File Detected	medium
112715	WordPress Plugins Sensitive Files Detected	medium
112425	ELMAH Information Disclosure	medium
98779	Source Code Passive Disclosure	medium
98680	CVS Repository Detected	medium
98671	CVS Entries Detected	medium
98650	SVN Repository Detected	medium
98646	.DS_Store File Detected	medium
98920	Disclosed US Social Security Number	medium
98632	WS_FTP.LOG File Detected	medium
98611	Error Message	info
98595	Gitignore File Detected	medium
98594	Web.config File Information Disclosure	medium
112531	Git Repository Detected	medium
112550	Full Path Disclosure	info
98129	Credit Card Number Disclosure	medium
98098	Source Code Disclosure	medium
98079	CVS/SVN User Disclosure	medium
98078	E-mail Address Disclosure	info
98077	Private IP Address Disclosure	info
98074	Backup File	medium
98073	Backup Directory	medium

Detections

Analytics

Data Exposure Family for Web App Scanning

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

info

medium

medium

medium

info

medium

medium

medium

info

info

medium

medium