Description
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pawelmalak flame
Default version status: unaffected
0 to ≤ 2.4.0affected
References
- https://github.com/pawelmalak/flame/issues/494 ↗
- https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/controllers/config/getConfig.js#L7-L13 ↗
- https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/routes/config.js#L14 ↗
- https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/utils/init/initialConfig.json#L2 ↗
- https://github.com/pawelmalak/flame ↗
- https://www.vulncheck.com/advisories/flame-through-2.4.0-information-exposure-via-get-api-config ↗