Summary
WWBN AVideo versions prior to 29.0 expose the application's .env file to unauthenticated users when deployed using the official Docker Compose configuration.
Because the project root is mounted as the web document root with no protection for dotfiles, attackers can download sensitive environment configuration and use it to access the database, hijack admin accounts, and move laterally inside the Docker network.
WWBN AVideo versions prior to 29.0 expose the application's .env file to unauthenticated users when deployed using the official Docker Compose configuration.
Because the project root is mounted as the web document root with no protection for dotfiles, attackers can download sensitive environment configuration and use it to access the database, hijack admin accounts, and move laterally inside the Docker network.
Affected context
The vulnerability occurs in WWBN AVideo instances deployed with the official Docker Compose setup where the entire application directory is mounted as the Apache document root.
In this layout, .env resides within the web-served path and is not protected by web server rules or .htaccess directives.
Any environment where this configuration is used, and where the web server directly serves the project root, may be affected, especially if dotfiles are not explicitly blocked at the HTTP layer.
The vulnerability occurs in WWBN AVideo instances deployed with the official Docker Compose setup where the entire application directory is mounted as the Apache document root.
In this layout, .env resides within the web-served path and is not protected by web server rules or .htaccess directives.
Any environment where this configuration is used, and where the web server directly serves the project root, may be affected, especially if dotfiles are not explicitly blocked at the HTTP layer.
Exploit preconditions
- Attack surface: Public HTTP/HTTPS interface of the AVideo instance
- Required access: No authentication; standard web access is sufficient
- Trigger point: Direct HTTP GET request to
/.envor equivalent URL path - Why exploitation is possible: The Docker Compose configuration maps the application root as the web document root without excluding sensitive files, and the web server is not configured to deny access to dotfiles or
.envspecifically.
- Attack surface: Public HTTP/HTTPS interface of the AVideo instance
- Required access: No authentication; standard web access is sufficient
- Trigger point: Direct HTTP GET request to
/.envor equivalent URL path - Why exploitation is possible: The Docker Compose configuration maps the application root as the web document root without excluding sensitive files, and the web server is not configured to deny access to dotfiles or
.envspecifically.
Why this happens
The underlying issue is an insecure default deployment configuration that places sensitive configuration artifacts directly under the web document root.
This maps to CWE-20: Improper Input Validation in the sense that the system implicitly trusts file path requests and does not validate or constrain which files under the document root may be served.
More abstractly, it is an instance of configuration exposure where environment-specific secrets are stored alongside publicly accessible assets, and the HTTP server lacks deny rules or routing logic to prevent arbitrary file retrieval.
The underlying issue is an insecure default deployment configuration that places sensitive configuration artifacts directly under the web document root.
This maps to CWE-20: Improper Input Validation in the sense that the system implicitly trusts file path requests and does not validate or constrain which files under the document root may be served.
More abstractly, it is an instance of configuration exposure where environment-specific secrets are stored alongside publicly accessible assets, and the HTTP server lacks deny rules or routing logic to prevent arbitrary file retrieval.
Potential impact
- Disclosure of database credentials and connection parameters
- Compromise of administrator accounts using exposed admin passwords or reset tokens
- Unauthorized read/write access to the application database
- Lateral movement within the Docker network using leaked internal service details
- Facilitation of further attacks such as data exfiltration, content tampering, or user impersonation
- Disclosure of database credentials and connection parameters
- Compromise of administrator accounts using exposed admin passwords or reset tokens
- Unauthorized read/write access to the application database
- Lateral movement within the Docker network using leaked internal service details
- Facilitation of further attacks such as data exfiltration, content tampering, or user impersonation
General mitigation guidance
Effective mitigation focuses on separating secrets from public content and constraining what the web server is allowed to serve.
Common defensive patterns include:
- Structuring deployments so that the web document root contains only static/public assets, not application source or configuration files
- Storing secrets in environment variables, dedicated secret stores, or configuration volumes that are not mapped to the web root
- Applying web server rules to block access to dotfiles (e.g., files starting with a dot) and to known sensitive filenames such as
.env - Using defense-in-depth controls such as network segmentation and least-privilege database accounts so that exposed credentials have limited impact
Effective mitigation focuses on separating secrets from public content and constraining what the web server is allowed to serve.
Common defensive patterns include:
- Structuring deployments so that the web document root contains only static/public assets, not application source or configuration files
- Storing secrets in environment variables, dedicated secret stores, or configuration volumes that are not mapped to the web root
- Applying web server rules to block access to dotfiles (e.g., files starting with a dot) and to known sensitive filenames such as
.env - Using defense-in-depth controls such as network segmentation and least-privilege database accounts so that exposed credentials have limited impact
How teams detect issues like this
Organizations can detect similar issues through:
- Automated checks in CI/CD pipelines that scan container and web server configurations for mappings of sensitive files into public document roots
- Security testing that actively probes for access to
.env, configuration files, and other dotfiles over HTTP - Static analysis or policy-as-code rules that flag docker-compose and web server configurations where application roots are directly exposed
- Periodic external attack surface reviews focusing on misconfigurations and direct file exposure patterns
Organizations can detect similar issues through:
- Automated checks in CI/CD pipelines that scan container and web server configurations for mappings of sensitive files into public document roots
- Security testing that actively probes for access to
.env, configuration files, and other dotfiles over HTTP - Static analysis or policy-as-code rules that flag docker-compose and web server configurations where application roots are directly exposed
- Periodic external attack surface reviews focusing on misconfigurations and direct file exposure patterns
