Researchers Discover Remotely Exploitable Flaw that Results in File Exposure on Gurock TestRail

guest · Sep 23, 2021

Researchers Discover Remotely Exploitable Flaw that Results in File Exposure on Gurock TestRail
September 22, 2021
https://www.technadu.com/researcher...results-file-exposure-gurock-testrail/303186/

An information disclosure vulnerability on Gurock TestRail could expose very sensitive files and data.

The particular product is used by government entities and leading organizations in the United States.

The researchers who figured it out have alerted the software vendor but got no response.

Click to expand...

Researchers John Jackson and “SickCodes” have discovered and figured a way to remotely exploit “CVE-2021-40875”, a client-side vulnerability in Gurock TestRail versions 7.2.0.3014 and older, which results in file exposure. As detailed in the technical report, a threat actor may access the ‘/files.md5’ file on the client app and get a full list of app files and file paths. Then, the paths can be tested, oftentimes leading to the disclosure of sensitive information like hardcoded credentials, API keys, etc.

TestRail is a centralized software testing and management platform to control, track, and organize software testing efforts.
It’s used by government agencies and organizations like NASA, as well as companies like Cisco, Salesforce, Paypal, eBay, HP, Autodesk, Adobe, Amazon, Sony, Intel, Apple, FedEx, etc.
Click to expand...

The researchers reported the problem to Gurock nine days ago after accessing a couple of very worrying examples of sensitive credentials. The root cause of this flaw is an access control restriction, but securing the files.md5 path from public scrutiny would be effective mitigation.

However, the product vendor hasn’t responded with any messages and didn’t acknowledge the reception of the report, so the researchers decided to go ahead with the publication of the flaw. Of course, some things have been omitted since the issue remains unpatched.
Click to expand...

Log in or Sign up

Researchers Discover Remotely Exploitable Flaw that Results in File Exposure on Gurock TestRail

guest Guest

Log in or Sign up

Researchers Discover Remotely Exploitable Flaw that Results in File Exposure on Gurock TestRail

guest Guest

Useful Searches