hunt-info-disclosure

## Crown Jewel Targets Information disclosure is the most-volume bug class in bug bounty (~30% of all disclosed reports across H1/Bugcrowd hacktivity), but the paying surface has shifted decisively toward **systemic credential exposure** rather than one-off PII leaks. Reflected stack traces on a 404 page are mid-three-figure or N/A on most programs; an exposed `/actuator/heapdump` containing AWS keys is mid-five-figure-class because it cascades to RCE on production cloud infrastructure. The 24-month meta crystallized around seven asset types. All CVEs below are NVD-verified. **1. Spring Boot Actuator exposure (mid four-figure to mid five-figure when chained to cloud takeover).** Wiz Threat Research Dec 2024 analysis: **60% of cloud environments use Spring Boot Actuator, 11% expose instances publicly to the internet, 24% of exposed instances are misconfigured.** **Volkswagen 9TB GPS data disclosure** — single open `/actuator/heapdump` endpoint provided plaintext AWS keys via heap dump, attackers downloaded 9 TB of GPS data from hundreds of thousands of cars. Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (SYSCREST analysis Feb 2025), https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz research summary Dec 2024). NVD-verified CVEs in the family: - **CVE-2025-41243 Spring Cloud Gateway Server Webflux property modification (CVSS 10.0 CRITICAL)** — when actuator gateway endpoint exposed via `management.endpoints.web.exposure.include=gateway`, attackers modify Spring Environment properties remotely → potential RCE. Affects 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x. Fix in 4.3.1 / 4.2.5 (OSS); 4.1.11 / 3.1.11 (Enterprise). - **CVE-2025-41253 Spring Cloud Gateway info-disclosure (CVSS 7.5 HIGH)** — SpEL injection on actuator endpoint exposes environment variables and system properties (DB credentials, API keys, internal URLs). - **CVE-2025-22235 Spring Boot EndpointRequest.to() wrong matcher (CVSS 7.3 HIGH)** — disabled actuator endpoint creates unprotected `/null/**` matcher path. - **CVE-2025-8525 Exrick xboot Spring Boot Admin/Actuator info disclosure** (CVSS 5.5 MEDIUM). - **CVE-2025-8738 zlt2000 microservices-platform actuator interface** (CVSS 5.5 MEDIUM). The Wiz dashboard checklist for actuator endpoints: `/health` (low), `/prometheus` `/metrics` (medium), `/env` (HIGH — never expose), `/heapdump` (CRITICAL — never expose), `/beans` `/mappings` `/loggers` (high — internal/auth only), `/shutdown` (HIGH — disabled by default, never enable). **2. `.git/` and `.env` mass exposure (mid four-figure direct + supply-chain cascades).** Two large 2024-2025 disclosures show this is industrialized: - **Sysdig EmeraldWhale Oct 2024** — automated scanning of IP ranges for exposed `/.git/config` files. Stole **15,000 cloud credentials from 67,000 URLs** (28K Git repos, 6K GitHub tokens, 2K validated active credentials). Stored stolen secrets in 1TB S3 bucket. Reference: https://sysdig.com/blog/emeraldwhale, https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/. - **Unit42 (Palo Alto) Aug 2024** — large-scale .env extortion campaign scanned 110,000 domains, identified **90,000 unique combos of leaked env-vars including 7,000 active AWS access keys**. Targeted Mailgun-mentioning .env files for legitimate-domain phishing. Reference: https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation. Pattern: web servers serving Laravel, Symfony, Rails, Django apps mistakenly serve the application root including `.env` and `.git/`. Hunt with: `curl -s https://target/.env`, `curl -s https://target/.git/config`, `curl -s https://target/.git/HEAD`. Then `git-dumper https://target/.git/ /tmp/dumped` to recover the full repo. **Disclosed bug bounty cases**: NASA `_x3ro_` Bugcrowd disclosure (Aug 2025, P3) — publicly accessible `.env` on NASA Bitbucket exposed UAT credentials for `cmr.sit.earthdata.nasa.gov`. Reference: https://redpacketsecurity.com/bugcrowd-bugbounty-disclosure-publicly-accessible-env-file-exposing-hardcoded-credentials-on-nasa-s-git-repository. **3. Source-code repository secret leakage (CWE-798, low five-figure on triage-friendly programs).** **GitGuardian 2026 State of Secrets Sprawl**: 28.65M new hardcoded secrets added to public GitHub repos in 2025 (34% YoY increase). **GitHub's own 2024 secret-scanning report**: 39M secret leaks. **IEEE S&P 2025 academic study**: up to 30% of projects at risk. **Starbucks H1 #716292 (2019, Cremit reference)** — single leaked JumpCloud API key in public GitHub repo, classified CWE-798, **CVSS 9.7 critical**, paid bounty — proof that bug bounty programs CAN treat credential exposure as paying class. Reference: https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure (Apr 2026 Cremit research on this exact pattern). Hunt with **TruffleHog** (https://github.com/trufflesecurity/trufflehog, 26K+ stars, 800+ detectors, **active credential verification** against provider APIs to confirm still-live keys). Same pattern via **GitGuardian**, **Snyk Code SAST**, **GitHub Secret Scanning**. Caveat from Cremit Apr 2026 analysis: **most bug bounty programs still classify credential exposure as out-of-scope** — check program scope before reporting; many specifically EXCLUDE this finding class. **4. Cloud-bucket misconfig (S3, GCS, Azure Blob — mid four-figure when PII counted; informational P5 when generic).** **ESHYFT March 2025** — 108GB / 86,341 healthcare-worker records (medical IDs, drivers licenses, SSNs, prescription records, disability claims) in unsecured S3 bucket; researcher Jeremiah Fowler discovered, took >1 month for org to close. Reference: https://www.theregister.com/2025/03/11/uber_for_nurses_exposes_86k/. **NASA Bugcrowd disclosure Feb 2025** — PDF in public S3 bucket (P5 informational only — NASA's VDP triages cloud-bucket findings strictly). Reference: https://bugcrowd.com/disclosures/aa45924f-8b67-4f22-8dff-dac7dc9d60e2/exposure-of-pdf-file-in-a-public-amazon-s3-bucket-associated-with-nasa. Hunt with **`s3scanner`**, **`AWSBucketDump`**, subdomain enumeration → `<name>.s3.amazonaws.com`, `<name>.blob.core.windows.net`, `<name>.storage.googleapis.com`. The Wiz Cloud Security Index annual report tracks the most-common misconfig classes. **5. Debug endpoint family (Spring actuator, Go pprof, Glances, FUXA, NetBird, Harbor — low four-figure to low five-figure depending on what's exposed).** All NVD-verified or GHSA-verified, all 2025-2026: - **Dgraph `/debug/pprof/cmdline` (GHSA-95mq-xwj4-r47p)** — unauthenticated debug endpoint exposes full process command line including admin token from `--security "token=..."`. Critical. - **Glances `/api/4/serverslist` (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh)** — Central Browser mode REST API returns raw server objects with reusable downstream credentials; permissive CORS allows any origin. - **FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx)** — unauthenticated remote attacker retrieves administrative database credentials. - **Harbor default password (GHSA-hj7x-hmf2-hc2p)** — GoHarbor v2.15.0 and below allows default password for web UI login. - **NetBird VPN (GHSA-g3j4-58mp-3x25)** — installation script fails to remove ZITADEL-created default admin password. - **MinIO LDAP brute-force (GHSA-jv87-32hw-hh99)** — `AssumeRoleWithLDAPIdentity` STS endpoint vulnerable to brute-forcing due to user enumeration + missing rate limit. - **PraisonAI WebSocket Gateway (GHSA-cfh6-vr3j-qc3g)** — `/ws` and `/info` endpoints serve agent topology with no auth; any network client can connect, enumerate registered agents. - **Gradio ACL bypass (GHSA-j2jg-fq62-7c3h)** — file path ACL bypassed via case alteration; lack of case normalization. - **Rancher cluster template credentials in answers** — credentials not properly sanitized. - **ArgoCD Redis cache risky/missing crypto** — credentials cached without proper encryption. - **`/server-status`** Apache mod_status endpoint — H1 report 2473173 (2026 High) — exposed at `https://203.137.128.240/server-status` leaks request URLs, IPs, vhosts. **6. PII exposure via API misconfiguration (CVSS-Confidentiality-only, low four-figure to low five-figure depending on record count).** Recent disclosed examples: - **ASBS soldiers PII** (H1 2026 critical) — viewing other soldiers' Personnel Information / Board / Board Voters via the Army Body Score System. - **`/talos/api/v1/files/upload` Critical Information Disclosure** (H1 report 3228011, 2025 critical). - **IBM Aspera HTTP Gateway** (H1 report 3340797, 2026 high) — sensitive information stored in clear text in easily obtainable files. - **ORDER_ERROR_LOG PII Data Exposure** (H1 2026 high) — error-log endpoint returns PII for any order ID. - **Session Cookie Leakage via Static Header Field in WebViewerFragment** (H1 2026 high) — mobile WebView leaks session via static header. Hunt: every API endpoint that returns user data, every error/log endpoint, every export feature, every `/me` and `/users/{id}` route. **7. WordPress wp-config.php exposure (mid three-figure to mid four-figure; reliable VDP filler).** Multiple H1 reports 2026: report 3328408 (National Guard website), report 3252302. Pattern: `.bak`, `.old`, `~`, `.swp` backup files served alongside `wp-config.php` containing DB credentials. Hunt with: `curl https://target/wp-config.php{,.bak,.old,~,.swp}`. The BackupFinder ffuf wordlist covers the common variants. **Memory disclosure (Heartbleed-class, when found pays mid five-figure).** **Dgraph `/debug/pprof/cmdline`** above. **`.NET Framework ObjRefs Disclosure (CVE-2024-29059)`** — H1 2026 high — .NET Remoting ObjRefs reveal internal endpoints. Modern memory-disclosure findings rare but high-impact when chained. **Mobile / game / IoT disclosure** — **ASLR leak in Mario Kart World through LAN mode** (H1 2026 high). Mobile-app reverse-engineering finds API keys, internal URLs in compiled binaries. Game-engine memory disclosure via LAN/multiplayer protocols. **What pays the most:** Spring actuator heapdump → cloud takeover (mid five-figure when chained — Volkswagen-class). Source-code repo with active AWS keys (low five-figure on programs that accept the class — Starbucks H1 #716292 precedent). Mass-PII via API misconfig (mid four-figure × record-count multiplier on healthcare/financial). `.env` exposure with active credentials (low four-figure direct + chain to AWS infrastructure for upgrade). `.git/` exposure (low four-figure direct + recover full repo + extract secrets). Generic stack trace, version banners, README leak — N/A on most programs. ## Attack Surface Signals Greppable signals that this surface might exist: ```bash # Spring Boot Actuator endpoints (CVE-2025-41243 family + Volkswagen pattern) rg -n -e 'management\.endpoints\.web\.exposure\.include' \ -e 'spring-boot-starter-actuator' \ -g 'application*.{yml,yaml,properties}' -g '*.gradle' -g 'pom.xml' # Spring actuator endpoints exposed in code rg -n -e '@Endpoint' -e '@WebEndpoint' -e '@ReadOperation' --type java # Hardcoded secrets / credentials in source rg -n -e 'AKIA[0-9A-Z]{16}' \ -e 'AIza[0-9A-Za-z_-]{35}' \ -e 'sk_live_[0-9a-zA-Z]{24,}' \ -e 'ghp_[0-9a-zA-Z]{36}' \ -e 'github_pat_[0-9a-zA-Z]{82}' \ -e 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' \ -e 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' \ -g '!*.lock' -g '!node_modules' -g '!vendor' # Database connection strings rg -n -i -e 'jdbc:(?:mysql|postgresql|mariadb|oracle|mssql)://[^"\s]*:[^@\s]+@' \ -e 'mongodb(\+srv)?://[^"\s]*:[^@\s]+@' \ -e 'redis://[^"\s]*:[^@\s]+@' \ -e 'amqp://[^"\s]*:[^@\s]+@' # .env file references in code (suggest .env exists in deploy) rg -n -e 'process\.env\.\w+' -e 'os\.environ\[' -e 'env\(\'?\w+\'?\)' \ --type js --type ts --type py --type php # Debug / pprof endpoints in Go code rg -n -e 'net/http/pprof' -e '"/debug/pprof"' -e '_pprof' --type go # Verbose error / debug mode in framework configs rg -n -i -e 'debug\s*=\s*true' -e 'app_debug=true' \ -e 'DEBUG\s*:\s*True' -e 'DJANGO_DEBUG=True' \ -g '*.{yml,yaml,toml,ini,env,properties}' # Stack-trace exposure in error handlers (Express/Flask) rg -n -e 'app\.use\(function\(err' -e 'errorhandler\(' \ -e '@app\.errorhandler' -e 'send.*error\.stack' \ --type js --type ts --type py ``` HTTP-level signals on a live target: - `Server: Tomcat`, `X-Application-Context:`, `Server: Jetty` + `/actuator/health` returns 200 → **Spring Boot Actuator surface** (probe `/actuator/heapdump`, `/actuator/env`, `/actuator/beans`) - `Server: Apache` + Apache `mod_status` enabled → **`/server-status` info disclosure** (H1 report 2473173, 2026 High) - `X-Powered-By: PHP/X.Y.Z` + `phpinfo()` reachable at common paths → **CVE-class info disclosure** - `X-Powered-By: ASP.NET`, `.NET Remoting` enabled → **CVE-2024-29059 .NET Framework ObjRefs disclosure** family - Subdomain returns Laravel default page → probe `https://target/.env` directly - Any 200 OK on `https://target/.git/HEAD` or `https://target/.git/config` → **`.git/` exposure** (Sysdig EmeraldWhale class) - `Vary: Accept-Encoding` + `text/html` response on `https://target/wp-config.php{,.bak,.old,~}` → **WordPress wp-config exposure** (H1 reports 3328408, 3252302, 2026 High) - Open `<bucket>.s3.amazonaws.com`, `<bucket>.blob.core.windows.net`, `<storage>.googleapis.com` returns XML directory listing → **S3 / Azure / GCS bucket misconfig** (ESHYFT-class) - `/api/v1/info`, `/api/4/serverslist`, `/info`, `/version`, `/build-info` returning verbose data → **Glances-class** (GHSA-r297-p3v4-wp8m) - `/debug/pprof/cmdline` returns process command line including secrets → **Dgraph-class** (GHSA-95mq-xwj4-r47p) - Login page returning different responses for valid vs invalid usernames → **user enumeration** surface (MinIO GHSA-jv87-32hw-hh99 LDAP variant) - `/swagger.json`, `/api-docs`, `/openapi.json`, `/.well-known/openapi` exposed in production → **API documentation exposure**