HexBrain

Mapbox · Report #225537

Node modules path disclosure due to lack of error handling

Validstatus
lowseverity
17upvotes
11 Jul 2017disclosed

Summary

On May 2nd, 2017 @apapedulimu reported an issue where changing a POST request to a GET request on one of our integration servers returned a full error stack trace rather than an HTTP 404 error. The full error stack trace revealed the full path of the Node.js modules directory on the integration server. We deployed a fix to this issue whereby an HTTP 404 was returned instead.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original