Tidewave
Monthly
Filesystem path disclosure in Tidewave Phoenix 0.8.0 through 0.9.1 lets a hostile web page read the framework's configuration tag - including the application root path, Mix dependency paths, project name and local port - either from the /tidewave/connect JSON response or from the toolbar meta tag injected into rendered HTML pages. Neither response validates the Host header, so a page that DNS-rebinds its own domain to the loopback address can retrieve the tag with a same-origin request, which carries no Origin header, exposing the developer's local username and project layout. The issue is unauthenticated per the CVSS vector but requires the victim to visit the attacker's page; impact is limited to low-sensitivity reconnaissance (confidentiality only, no code execution or access gain), no public exploit code was identified at time of analysis, and the vendor fix is version 0.9.2.
Filesystem path disclosure in Tidewave Phoenix 0.8.0 through 0.9.1 lets a hostile web page read the framework's configuration tag - including the application root path, Mix dependency paths, project name and local port - either from the /tidewave/connect JSON response or from the toolbar meta tag injected into rendered HTML pages. Neither response validates the Host header, so a page that DNS-rebinds its own domain to the loopback address can retrieve the tag with a same-origin request, which carries no Origin header, exposing the developer's local username and project layout. The issue is unauthenticated per the CVSS vector but requires the victim to visit the attacker's page; impact is limited to low-sensitivity reconnaissance (confidentiality only, no code execution or access gain), no public exploit code was identified at time of analysis, and the vendor fix is version 0.9.2.