Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Visit `http://<target>/files.md5`. <br>2. If you see a list of files/paths, you are **VULNERABLE**. <br>3. Use automated scanners like Nuclei or the Python scripts linked in the data.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Improper Access Control in Gurock TestRail.
💥 **Consequences**: Attackers access `/files.md5` to get a full list of app files & paths.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **Improper Access Control** (IAC). The `/files.md5` file on the client side is accessible without proper restrictions, leaking internal file structures.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected**: **Gurock Software Gurock TestRail**.
📅 **Versions**: All versions **before 7.2.0.3014**.
🌍 **Context**: Web-based QA/test case management software.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

🕵️ **Attacker Actions**:
1. Access `/files.md5`.
2. Map application file paths.
3. Probe specific paths.
4. **Steal**: Hardcoded passwords, API keys, sensitive config data.

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

⚡ **Exploitation Threshold**: **LOW**.
🔓 **Auth**: No authentication required to access the `/files.md5` endpoint.
⚙️ **Config**: Default installation behavior allows this exposure.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

💣 **Public Exp/PoC**: **YES**.
🔗 Tools available:
- `derailed` (SakuraSamuraii)
- `TestRail-files.md5-IAC-scanner` (Lul)
- Nuclei templates (ProjectDiscovery).…

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**:
1. Visit `http:///files.md5`.
2. If you see a list of files/paths, you are **VULNERABLE**.
3. Use automated scanners like Nuclei or the Python scripts linked in the data.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

🩹 **Official Fix**: **YES**.
✅ **Patch**: Upgrade to version **7.2.0.3014** or later.
📢 **Status**: Fixed by Gurock Software.

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch Workaround**:
1. **Block Access**: Configure Web Server (Nginx/Apache) to deny requests to `/files.md5`.
2. **WAF Rules**: Add rule to block access to this specific endpoint.
3.…

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: **HIGH**.
⚠️ **Reason**: Easy to exploit, no auth needed, leads to credential/API key leaks.
🚀 **Action**: Patch immediately or block endpoint via WAF/Config.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2021-40875 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring