Starbucks · Report #401098
[mena.starbucks.com] Laravel App Log & Configuration Disclosure.
Validstatus
highseverity
63upvotes
30 Sept 2019disclosed
Summary
bobrov discovered a misconfiguration in a Laravel instance at mena.starbucks.com, which exposed log files and environment variables containing database management credentials. The logs have been removed, and the instance of Laravel has been disabled.
Thank you @bobrov for finding this misconfiguration and helping to resolve this issue!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.