## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official `docker-compose.yml` (line 61) mounts the entire project root directory as the Apache document root: ```yaml volumes: - "./:/var/www/html/AVideo" ``` This causes the `.env` file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at `/.env`. No `.htaccess` rule or Apache configuration blocks access to dotfiles. ### Exposed Information An unauthenticated request to `GET /.env` returns: ``` DB_MYSQL_HOST=database DB_MYSQL_USER=avideo DB_MYSQL_PASSWORD=avideo SYSTEM_ADMIN_PASSWORD=admin123 TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key NETWORK_SUBNET=172.30.0.0/16 ``` ## Steps to Reproduce ### Prerequisites - AVideo deployed using the official `docker-compose.yml` - No modifications to the default configuration ### Steps 1. Deploy AVideo using `docker compose up -d` 2. Send: `curl http://target/.env` 3. The full `.env` file contents are returned, including database credentials and admin password ## Impact - **Attacker**: Unauthenticated (any remote user) - **Victim**: AVideo server and database - **Specific damage**: Attacker obtains database credentials (`DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`), admin password (`SYSTEM_ADMIN_PASSWORD`), and internal network topology (`NETWORK_SUBNET`). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network. ## Proposed Fix Add a `.htaccess` rule to block access to dotfiles: ```apache # Block access to hidden files (.env, .git, etc.) <FilesMatch "^\."> Order Allow,Deny Deny from all </FilesMatch> ``` Or configure Apache to deny dotfile access in the virtual host configuration.
## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official `docker-compose.yml` (line 61) mounts the entire project root directory as the Apache document root: ```yaml volumes: - "./:/var/www/html/AVideo" ``` This causes the `.env` file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at `/.env`. No `.htaccess` rule or Apache configuration blocks access to dotfiles. ### Exposed Information An unauthenticated request to `GET /.env` returns: ``` DB_MYSQL_HOST=database DB_MYSQL_USER=avideo DB_MYSQL_PASSWORD=avideo SYSTEM_ADMIN_PASSWORD=admin123 TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key NETWORK_SUBNET=172.30.0.0/16 ``` ## Steps to Reproduce ### Prerequisites - AVideo deployed using the official `docker-compose.yml` - No modifications to the default configuration ### Steps 1. Deploy AVideo using `docker compose up -d` 2. Send: `curl http://target/.env` 3. The full `.env` file contents are returned, including database credentials and admin password ## Impact - **Attacker**: Unauthenticated (any remote user) - **Victim**: AVideo server and database - **Specific damage**: Attacker obtains database credentials (`DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`), admin password (`SYSTEM_ADMIN_PASSWORD`), and internal network topology (`NETWORK_SUBNET`). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network. ## Proposed Fix Add a `.htaccess` rule to block access to dotfiles: ```apache # Block access to hidden files (.env, .git, etc.) <FilesMatch "^\."> Order Allow,Deny Deny from all </FilesMatch> ``` Or configure Apache to deny dotfile access in the virtual host configuration.
Update wwbn/avideo to 29.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanAVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration affects wwbn/avideo (composer). Severity is high. ## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official `docker-compose.yml` (line 61) mounts the entire project root directory as the Apache document root: ```yaml volumes: - "./:/var/www/html/AVideo" ``` This causes the `.env` file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at `/.env`. No `.htaccess` rule or Apache configuration blocks access to dotfiles. ### Exposed Information An unauthenticated request to `GET /.env` returns: ``` DB_MYSQL_HOST=database DB_MYSQL_USER=avideo DB_MYSQL_PASSWORD=avideo SYSTEM_ADMIN_PASSWORD=admin123 TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key NETWORK_SUBNET=172.30.0.0/16 ``` ## Steps to Reproduce ### Prerequisites - AVideo deployed using the official `docker-compose.yml` - No modifications to the default configuration ### Steps 1. Deploy AVideo using `docker compose up -d` 2. Send: `curl http://target/.env` 3. The full `.env` file contents are returned, including database credentials and admin password ## Impact - **Attacker**: Unauthenticated (any remote user) - **Victim**: AVideo server and database - **Specific damage**: Attacker obtains database credentials (`DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`), admin password (`SYSTEM_ADMIN_PASSWORD`), and internal network topology (`NETWORK_SUBNET`). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network. ## Proposed Fix Add a `.htaccess` rule to block access to dotfiles: ```apache # Block access to hidden files (.env, .git, etc.) <FilesMatch "^\."> Order Allow,Deny Deny from all </FilesMatch> ``` Or configure Apache to deny dotfile access in the virtual host configuration.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| wwbn/avideocomposer | <29.0 | 29.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate wwbn/avideo to 29.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanAVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration affects wwbn/avideo (composer). Severity is high. ## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official `docker-compose.yml` (line 61) mounts the entire project root directory as the Apache document root: ```yaml volumes: - "./:/var/www/html/AVideo" ``` This causes the `.env` file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at `/.env`. No `.htaccess` rule or Apache configuration blocks access to dotfiles. ### Exposed Information An unauthenticated request to `GET /.env` returns: ``` DB_MYSQL_HOST=database DB_MYSQL_USER=avideo DB_MYSQL_PASSWORD=avideo SYSTEM_ADMIN_PASSWORD=admin123 TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key NETWORK_SUBNET=172.30.0.0/16 ``` ## Steps to Reproduce ### Prerequisites - AVideo deployed using the official `docker-compose.yml` - No modifications to the default configuration ### Steps 1. Deploy AVideo using `docker compose up -d` 2. Send: `curl http://target/.env` 3. The full `.env` file contents are returned, including database credentials and admin password ## Impact - **Attacker**: Unauthenticated (any remote user) - **Victim**: AVideo server and database - **Specific damage**: Attacker obtains database credentials (`DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`), admin password (`SYSTEM_ADMIN_PASSWORD`), and internal network topology (`NETWORK_SUBNET`). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network. ## Proposed Fix Add a `.htaccess` rule to block access to dotfiles: ```apache # Block access to hidden files (.env, .git, etc.) <FilesMatch "^\."> Order Allow,Deny Deny from all </FilesMatch> ``` Or configure Apache to deny dotfile access in the virtual host configuration.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| wwbn/avideocomposer | <29.0 | 29.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard