Technical information leak - SourceMap
Description
The .map files are exposed, making it easy for a malicious actor to analyze the application.
Impact
Understand the inner workings of the application to generate new attack vectors.
Recommendation
Limit access of map files to authorized users and roles.
Threat
Unauthorized user from the Internet.
Expected Remediation Time
⌚ 15 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: U
- Confidentiality: L
- Integrity: N
- Availability: N
Temporal
- Exploit code madurity: P
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
- Score:
- Base: 5.3
- Temporal: 5.0
- Severity:
- Base: Medium
- Temporal: Medium
Code Examples
Compliant code
The sourceMap files should only be used to debug production code but should not be included in the source code
(function() {
var greet, greetButton, person;
person = document.getElementById('person');
greet = function(greeting) {
return console.log(greeting + " " + person.value);
};
person.addEventListener("focus", function() {
return person.value = "";
});
greetButton = document.getElementById('greet');
greetButton.addEventListener("click", function() {
var greeting, helloOption;
helloOption = document.querySelector("#hello");
greeting = helloOption.checked ? "Hello" : "Goodbye";
return greet(greeting);
});
}).call(this);
Non compliant code
The source code includes direct access to SourceMap files
(function() {
var greet, greetButton, person;
person = document.getElementById('person');
greet = function(greeting) {
return console.log(greeting + " " + person.value);
};
person.addEventListener("focus", function() {
return person.value = "";
});
greetButton = document.getElementById('greet');
greetButton.addEventListener("click", function() {
var greeting, helloOption;
helloOption = document.querySelector("#hello");
greeting = helloOption.checked ? "Hello" : "Goodbye";
return greet(greeting);
});
}).call(this);
//# sourceMappingURL=http://example.com/path/to/your/sourcemap.map</pre>
Requirements
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.