CVE-2021-39174

high-risk
Published 2021-08-28

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Do I need to act?

!
52.4% chance of exploitation in next 30 days
EPSS score — higher than 48% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Catchethq

References (6)

Exploit https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-inj...
Release Notes https://github.com/fiveai/Cachet/releases/tag/v2.5.1
Third Party Advisory https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688
Exploit https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-inj...
Release Notes https://github.com/fiveai/Cachet/releases/tag/v2.5.1
Third Party Advisory https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688
53
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 18/34 · Moderate
Exposure 5/34 · Minimal