Executive brief
Insight API is a blockchain transaction query and broadcast service used by cryptocurrency wallets and exchanges. An attacker can send malformed requests to the transaction broadcast endpoint to trigger error messages that expose the full file system path of the server, revealing sensitive information about the application's deployment structure and potentially aiding further attacks.
Technical details
The transaction broadcast endpoint (/insight-api/tx/send) in Insight API versions 5.0.0 and earlier contains an input validation vulnerability (CWE-20) that fails to sanitize error messages. When an attacker sends unexpected or malformed data to the endpoint, the application returns unhandled exception details including full file system paths. This is exploitable via unauthenticated network requests without user interaction. The vulnerability discloses sensitive path information such as installation directories and third-party module locations, which aids reconnaissance for follow-up attacks. Patches are available in versions later than 5.0.0.
Affected products
- Bitpay Insight API 5.0.0 and earlier
Timeline
- 2018-03-05: disclosed