WWBN AVideo Unauthenticated .env File Exposure Vulnerability in Docker Deployment

A vulnerability exists in WWBN AVideo versions prior to 29.0, where the official Docker compose configuration exposes the .env file to unauthenticated users. The Docker compose file mounts the entire project root directory as the Apache document root, which allows the .env file—containing sensitive information such as database credentials, admin passwords, and infrastructure configuration—to be served as a static file. There are no .htaccess rules or Apache configurations to block access to dotfiles, enabling exploitation that could lead to direct database access, admin panel takeover, and lateral movement within the Docker network.

Impact

Exploitation of this vulnerability allows unauthenticated access to the .env file, revealing database credentials, the admin password, and internal network information. This access could be used to compromise the database, take over the admin panel, and move laterally within the Docker network.

Reproduction

To reproduce this vulnerability, deploy AVideo using the official Docker compose file without any modifications. After the application is running, send a request to the server for the .env file. The response will include sensitive information such as database credentials and the admin password.

Remediation

Users can update to AVideo version 29.0 or later, where this vulnerability has been addressed. For those using earlier versions, it is recommended to add a .htaccess file to block access to dotfiles or to configure Apache to deny access to hidden files through the virtual host settings.