PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing Exposed Sourcemaps

blog.sentry.security | blog | #account-takeover | #web-security | #information-disclosure | #javascript | #webpack | #sourcemaps
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Exposed Webpack sourcemaps can leak source code, secrets and hidden endpoints; one case saw a .map file reveal an undocumented endpoint enabling unauthorized password changes and account takeover.
Published
Collected

Related coverage

High · vulnerability · bishopfox.com
CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi
CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.
blog · blog.sentry.security
Cracking Password Reset Mechanisms
Password reset tokens derived from predictable data like an MD5-hashed timestamp let attackers hijack any account including admins; use random tokens, ownership checks and rate limiting.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · bishopfox.com
TaskCafe, Version 0.3.2 Advisory
Bishop Fox discloses three TaskCafe 0.3.2 vulnerabilities—improper access controls, stored XSS, and insecure file uploads—that chain to take over administrator accounts.
blog · bishopfox.com
EzAdsPro BlackBox Advisory
Advisory: the EzAdsPro 'BlackBox' platform left directory listings enabled across /feeds/, /sms/ and /blackbox/, exposing customer PII and hardcoded credentials; the vendor fixed it server-side.
blog · bishopfox.com
CATIE Web - Version 20.04.0
Four local file disclosure flaws in CATIE Web 20.04.0 let unauthenticated attackers read any host file, including source code and password hashes, as the service ran as root.
Back