Navtor NavBox Information Disclosure Vulnerability via Unhandled Exception

An information disclosure vulnerability has been identified in Navtor NavBox version 4.12.0.3. The issue arises in the /api/ais-data endpoint, where a remote, unauthenticated attacker can send crafted requests that trigger an unhandled exception. This exception causes the server to return detailed .NET stack traces, which include internal class names, method calls, and references to third-party libraries such as System.Data.SQLite. Such information could aid attackers in understanding the application's internal structure.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, allowing attackers to gain insights into the application's architecture and potentially identify further attack vectors.