CVE-2021-40875

Description

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control EDB-50320 · webapps · Sep 23, 2021

GitHub 2 repositories

SakuraSamuraii/derailed ★ 8 · Sep 13, 2021

CVE-2021-40875: Tools to Inspect Gurock Testrail Servers for Vulnerabilities related to CVE-2021-40875.
Lul/TestRail-files.md5-IAC-scanner ★ 2 · Feb 24, 2022

Python scanner for TestRail servers vulnerable to CVE-2021-40875

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Gurock TestRail Application files.md5 Exposure http/cves/2021/CVE-2021-40875.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the …