2

I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to access the DB.
But this DB is used on the LAN, so I can't access remotely. Is there a way to bypass this restriction, or even with the credentials there is no way to access this DB?

I want to know if this kind of scenarios is a game over or a hacker could still working with this vulnerabilities.

1
  • "Is there a way to bypass this restriction" There is no way for us to know from what little info you provided. The answer is "maybe" – schroeder Dec 29 '19 at 16:57
2

It depends...

Assuming the web server has access to the DB in the backend you could look for other vulnerabilities in the web application that allows RCE or even SSRF where you can further utilize the credentials you found.

See this for an example of how debug mode on Django was used to achieve RCE and extend access to other systems.

In case of RCE and SSRF you are executing commands as if you are the web server hence you inherit the connectivity of the web server which implies that you need to be able to communicate with the backend DB or other systems on the LAN not directly exposed to the public internet.

If you have mandate to look for issues on this application, I would certainly not stop there and neither would a good bug bounty hunter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.