HexBrain

Starbucks · Report #401098

[mena.starbucks.com] Laravel App Log & Configuration Disclosure.

Validstatus
highseverity
63upvotes
30 Sept 2019disclosed

Summary

bobrov discovered a misconfiguration in a Laravel instance at mena.starbucks.com, which exposed log files and environment variables containing database management credentials. The logs have been removed, and the instance of Laravel has been disabled.

Thank you @bobrov for finding this misconfiguration and helping to resolve this issue!

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original