Executive brief
Airbrake, a popular error monitoring and reporting service integration, was configured by default to send application environment variables over unencrypted HTTP connections. An attacker positioned on the network path between the application and Airbrake's servers could intercept and read these environment variables, potentially exposing sensitive credentials, API keys, and configuration secrets.
Technical details
The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected versions of the airbrake npm package transmitted environment variables via unencrypted HTTP, making them vulnerable to passive network interception. This affects all versions prior to 0.4.0. An attacker with network access between the application and Airbrake's servers (e.g., on a shared network, compromised router, or via man-in-the-middle position) can capture the HTTP traffic and extract sensitive environment data. The fix involves upgrading to version 0.4.0 or later, or migrating to the replacement airbrake-js package.
Affected products
- Airbrake airbrake before 0.4.0
Timeline
- 2019-02-18: disclosed
- 2016: patched: CVE-2016-10530 indicates fix was available by 2016