Mapbox · Report #225537
Node modules path disclosure due to lack of error handling
Validstatus
lowseverity
17upvotes
11 Jul 2017disclosed
Summary
On May 2nd, 2017 @apapedulimu reported an issue where changing a POST request to a GET request on one of our integration servers returned a full error stack trace rather than an HTTP 404 error. The full error stack trace revealed the full path of the Node.js modules directory on the integration server. We deployed a fix to this issue whereby an HTTP 404 was returned instead.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.