Test case 14 / 26FAIL
Sensitive Data Exposure - Web Root - Environment Files
Lab environment — not a production system
Screenshots and raw traffic are not translated; text within them may be in another language.
vuln-bank/Evidence/[FAIL] Sensitive Data Exposure - Web Root - Environment Files
01 — Notes
Test notes
Vulnerability
[FAIL] Sensitive Data Exposure - Web Root - Environment Files
Description
The environment configuration file .env and its backup copy .env.bak are served directly from the web root without authentication. These files contain the application secret key, JWT secret, and database credentials.
Impact
Confidentiality (High): an unauthenticated attacker obtains the application SECRET_KEY, JWT_SECRET, and the database host, name, user, and password. With JWT_SECRET, any session token can be forged with a valid signature, including an administrator token. The database credentials allow direct access to the data store if the database network is reachable.
CWE
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
OWASP
A05:2021 - Security Misconfiguration
Scenario
Exploitation: a normal GET request to /.env without authentication -> HTTP 200 with the configuration file contents. The backup file /.env.bak is also served, exposing the older configuration including credentials that may still be valid.
Endpoint
GET http://127.0.0.1:5001/.env
GET http://127.0.0.1:5001/.env.bak
Affected feature
Static file serving from the web root
Remediation
- Do not place configuration files inside the web root, and do not create routes that serve them.
- Block access to dot-prefixed and backup-extension files at the reverse proxy.
- Move secrets into a secret manager or environment variables that are not servable files.
- Rotate the exposed SECRET_KEY, JWT_SECRET, and database credentials.
Proof of concept
1) (Screenshot 1) EXPLOITATION: GET /.env without authentication -> HTTP 200, SECRET_KEY, JWT_SECRET, and database credentials are exposed.
2) (Screenshot 2) CIA IMPACT: GET /.env.bak -> HTTP 200, the backup configuration copy is also publicly downloadable.
View source note (English)
Vulnerability:
[FAIL] Sensitive Data Exposure - Web Root - Environment Files
Description:
The environment configuration file .env and its backup copy .env.bak are served directly from the web root without authentication. These files contain the application secret key, JWT secret, and database credentials.
Impact:
Confidentiality (High): an unauthenticated attacker obtains the application SECRET_KEY, JWT_SECRET, and the database host, name, user, and password. With JWT_SECRET, any session token can be forged with a valid signature, including an administrator token. The database credentials allow direct access to the data store if the database network is reachable.
CWE:
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
OWASP:
A05:2021 - Security Misconfiguration
Scenario:
Exploitation: a normal GET request to /.env without authentication -> HTTP 200 with the configuration file contents. The backup file /.env.bak is also served, exposing the older configuration including credentials that may still be valid.
Endpoint:
GET http://127.0.0.1:5001/.env
GET http://127.0.0.1:5001/.env.bak
Affected Feature:
Static file serving from the web root
Remediation:
- Do not place configuration files inside the web root, and do not create routes that serve them.
- Block access to dot-prefixed and backup-extension files at the reverse proxy.
- Move secrets into a secret manager or environment variables that are not servable files.
- Rotate the exposed SECRET_KEY, JWT_SECRET, and database credentials.
POC:
1) (Screenshot 1) EXPLOITATION: GET /.env without authentication -> HTTP 200, SECRET_KEY, JWT_SECRET, and database credentials are exposed.
2) (Screenshot 2) CIA IMPACT: GET /.env.bak -> HTTP 200, the backup configuration copy is also publicly downloadable.
02 — Screenshots
Screenshots (2)
03 — Requests and responses
HTTP captures
Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.
CAPTURE 01 / 1
GET /.env HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 571
Content-Disposition: inline; filename=".env"
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:02:21 GMT
APP_ENV=production
FLASK_DEBUG=true
SECRET_KEY=8f6d3e9027474fd8b516ac09e319e2ef
JWT_SECRET=00af85a8f47d41f7bfb9ce45ad1130aa
DB_HOST=vulnbank-db.internal
DB_PORT=5432
DB_NAME=vulnerable_bank
DB_USER=vulnbank_prod
DB_PASSWORD=VbProd_2026_DbAccess!
DATABASE_URL=postgresql://vulnbank_prod:VbProd_2026_DbAccess!@vulnbank-db.internal:5432/vulnerable_bank
REDIS_URL=redis://:VbRedis_2026!@vulnbank-cache.internal:6379/0
DEEPSEEK_API_KEY=ds_live_7f3b9d82c1264ea0a8c77f90
SMTP_HOST=mail.vulnbank.internal
SMTP_PORT=587
SMTP_USER=[REDACTED-EMAIL]
SMTP_PASSWORD=MailRelay_2026!
CAPTURE 02 / 2
GET /.env.bak HTTP/1.1
User-Agent: python-requests/2.33.1
Accept-Encoding: gzip, deflate, br, zstd
Accept: */*
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 494
Content-Disposition: inline; filename=".env.bak"
Access-Control-Allow-Origin: *
Server: Werkzeug/2.0.1 Python/3.9.25
Date: Wed, 30 Sep 2026 03:02:22 GMT
APP_ENV=production
FLASK_DEBUG=true
SECRET_KEY=5c78f362be4b4ad8bc395325aa46fe71
JWT_SECRET=9b66150da3e54310923fde26a558ec87
DB_HOST=10.20.30.40
DB_PORT=5432
DB_NAME=vulnerable_bank
DB_USER=vulnbank_admin
DB_PASSWORD=VulnBankAdmin_2025!
DATABASE_URL=postgresql://vulnbank_admin:VulnBankAdmin_2025!@10.20.30.40:5432/vulnerable_bank
ADMIN_USERNAME=ops_admin
ADMIN_PASSWORD=VbOperations_2025!
SMTP_HOST=10.20.30.25
SMTP_PORT=587
SMTP_USER=[REDACTED-EMAIL]
SMTP_PASSWORD=LegacyMail_2025!