PT-2021-11640 · Webpack+1 · Webpack+1

Published 2021-01-06 · Updated 2021-01-13 · CVE-2020-29041

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Web-Sesame version 2020.1.1.3375

Description: A misconfiguration in the software allows an unauthenticated attacker to download the source code of the application. This is due to JavaScript source maps being inadvertently included in the production Webpack configuration, which contain sources used to generate the bundle, configuration settings such as API keys, and developers' comments.

Recommendations: For Web-Sesame version 2020.1.1.3375, remove the JavaScript source maps from the production Webpack configuration to prevent unauthorized access to the application's source code. Consider restricting access to sensitive configuration settings and developers' comments until a more permanent fix is implemented.

Exploit

Fix

Related Identifiers

CVE-2020-29041

Affected Products

Web-Sesame

Webpack

References · 5

• 🔥 https://blog.bssi.fr/vulnerabilite-de-divulgation-de-code-source-identifiee-au-sein-de-lapplication-web-sesame-de-til-technologies · Exploit
• 🔥 https://blog.bssi.fr/source-code-vulnerability-disclosure-discovered-in-the-web-sesame-application-of-til-technologies · Exploit
• https://osv.dev/vulnerability/CVE-2020-29041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29041 · Security Note
• https://t.me/cibsecurity/21720 · Telegram Post