Mintify Web Infrastructure Security Review Report
January 2024
Scope
*.mintify.xyz
Summary
Weaknesses
This section contains the list of discovered weaknesses.
MNTF-3. API KEY EXPOSURE
Severity:
Status:
Fixed
Description:
The inadvertent exposure of API keys has been detected, posing a significant risk of unauthorized access to sensitive systems.
Remediation:
Key Concealment: Refrain from embedding API keys directly in the code.
Access Restriction: Rigorously control and validate access to API keys.
Secure Storage: Utilize secure storage methods, avoiding hardcoded keys.
Monitoring: Establish proactive monitoring measures to swiftly identify and respond to any unauthorized activities.
MNTF-1. CLOUDFLARE EXTERNAL IMAGE RESIZE
Severity:
Status:
Fixed
Description:
https://trade.mintify.xyz/cdn-cgi/image/width/<External_Server>
https://api.mintify.xyz/cdn-cgi/image/width/<External_Server>
https://t2.mintify.xyz/cdn-cgi/image/width/<External_Server>
https://app.mintify.xyz/cdn-cgi/image/width/<External_Server>
https://store.mintify.xyz/cdn-cgi/image/width/<External_Server>
https://genesis-metas.mintify.xyz/cdn-cgi/image/width/<External_Server>
A vulnerability has been identified in the external image resizing mechanism through Cloudflare, potentially leading to insecure image operations and exploitable scenarios.
Remediation:
Access Restriction: Implement strict access controls for the external image resizing function.
Authentication: Introduce authentication mechanisms to validate requests for image resizing.
Monitoring: Set up a monitoring system to detect unusual activity and suspicious image resizing requests.
Update and Patching: Regularly update Cloudflare software and apply patches to mitigate potential vulnerabilities.
MNTF-2. FULL PATH DISCLOSURE VIA POOR EXCEPTION HANDLING
Severity:
Status:
Fixed
Description:
A vulnerability allowing the exposure of full file paths due to improper exception handling has been identified. This could lead to leakage of confidential information and create an opportunity for potential attacks.
Remediation:
Secure Exception Handling: Rectify exception handling to prevent path exposure.
Information Restriction: Minimize error details to avoid revealing system structure.
Security Logging: Maintain secure event logs to detect potential exploitation attempts.
Code Audits: Regularly audit code to identify and address such vulnerabilities.
MNTF-4. CORS, ARBITRARY DOMAIN TRUST
Severity:
Status:
Fixed
Description:
A vulnerability in CORS has been identified, allowing arbitrary domains to access resources and creating the potential for cross-site attacks.
Remediation:
Access Restriction: Allow access only to trusted domains.
CORS Headers: Configure CORS headers to define access rules.
Trust Verification: Verify domains before granting access to requests.
Regular Audits: Conduct periodic security audits to detect and address such vulnerabilities.