Insomnia Cookies exposes database passwords, then quietly fixes the leak
American bakery company sweetly remembered for its late-night warm cookie trucks across college campuses was caught leaking sensitive data on its website.
The data exposed via public .env files included production server database credentials, including the DB server addresses, ports, usernames, passwords, and API keys.
.env files contain sensitive configuration data such as environment variables, API keys, passwords, and are supposed to remain private, hidden from prying eyes of the public.
The exposed .env file provided enough information for an attacker to potentially be able to access the Insomnia Cookies database and carry all sorts of attacks, such as dropping entire databases, or illicitly obtaining the information contained within them, such as customer data.
Bob Diachenko, Cyber Threat Intelligence researcher who discovered the flaw on November 12th via public IoT search engines (such as Shodan), responsibly reported it to Insomnia Cookies.
However, Diachenko didn’t receive a response. And it seems, Insomnia Cookies quietly patched the flaw following Diachenko’s report.
“Insomnia Cookies left almost all of their prod credentials exposed via publicly accessible dot-env file on one of its IPs (indexed by all IoT search engines). Silently secured after responsible disclosure, no response,” tweeted Diachenko.
Diachenko told Security Report he had discovered the data leak last week via public IoT search engines and immediately reported it to Insomnia Cookies:
“I discovered that one on Nov 12th and immediately sent alert to IC.”
“Basically, dot-env is environment variables file for internal usage only. Developers define here settings for databases and endpoints so if you have this, most of the company’s infrastructure is compromised,” Diachenko told Security Report.
When building and publishing websites to production environment, it may be wise to check file permissions, to prevent data leaks such as this one.
Security Report has reached out to Insomnia Cookies for comment but haven’t heard back yet.
About the author
Carbanak Banking Malware Resurfaces with Updated Tactics in Ransomware Attacks 
Theme park giant Parques Reunidos hit by a ransomware cyber attack 
Phishing kit screenshots your email domain on the fly to appear real 
Royal Mail online tracking returns — with a frustrating captcha that works half the time 
New convincing phishing campaign targets Booking.com and Blockchain.com customers 
Movie studios sue TorGuard after $10 million legal battle with LiquidVPN 
Sea Turtle Cyber Espionage Campaign Targets Telecommunication and IT Companies in the Netherlands 
Rogue WordPress plugin: Threat hunters uncover credit card skimming campaign targeting e-commerce sites 
Albanian Parliament and telco ‘One Albania’ suffer cyber attacks