Description
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yogeshojha | rengine | ≤ 2.2.0 | — |
References
- GitHub Issue #1554 issue-tracking
- https://github.com/yogeshojha/rengine product
- https://github.com/yogeshojha/rengine/blob/302b5f32e7aa5958fec9e405772f4aa069eb21a2/web/api/views.py#L1607-L1700 technical-description
- https://github.com/yogeshojha/rengine/blob/302b5f32e7aa5958fec9e405772f4aa069eb21a2/web/reNgine/settings.py#L129-L141 technical-description
- VulnCheck Advisory: reNgine through 2.2.0 Unauthorized Configuration File Read third-party-advisory