Shopify · Report #157876

(FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'

Validstatus

8upvotes

1 Sept 2016disclosed

Summary

A staging instance of the application was available with no authentication at shardm-reader.chi2.shopify.io. Since this instance had verbose errors turned on, any error message would contain information about the application's environment variables, and part of the stack trace with application source code.

How it was found

Hello,

Found a website of you guys that is poiting to: shardm-reader.chi2.shopify.io' This domain is disclosure fill path because there is none MySQL server host.

POC: https://104.196.154.1/

Response a whole page with path disclosures:

lib/patches/mysql_monitoring.rb:19:in connect' lib/patches/mysql_monitoring.rb:19:in block in raw_connect_with_monitoring' lib/patches/mysql_monitoring.rb:18:in raw_connect_with_monitoring' lib/routing/connection.rb:15:in connection' app/models/concerns/benchmarking.rb:15:in block (2 levels) in add_benchmark_around_method' app/models/concerns/benchmarking.rb:24:in with_benchmark' app/models/concerns/benchmarking.rb:14:in block in add_benchmark_around_method' app/models/shop.rb:619:in for_domain' app/controllers/application_controller.rb:303:in shop_for' app/controllers/application_controller.rb:96:in with_shop_fallback' app/controllers/application_controller.rb:87:in with_shop' app/controllers/application_controller.rb:73:in set_billing_api_request_id' app/controllers/application_controller.rb:64:in add_request_id_to_log_context' app/controllers/application_controller.rb:245:in conditionally_enable_debug_log' app/controllers/application_controller.rb:54:in block in identity_cache_memoization' app/controllers/application_controller.rb:54:in identity_cache_memoization' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in call' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in block in measure' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:53:in duration' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in measure' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:75:in block (3 levels) in statsd_measure' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in call' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in block in measure' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:53:in duration' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:284:in measure' /artifacts/ruby/2.2.0/bundler/gems/statsd-instrument-50b2496ea65b/lib/statsd/instrument.rb:75:in block (2 levels) in statsd_measure' semian (0.4.1) lib/semian/mysql2.rb:82:in `block in connect'

Please let me know!!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original