Public Exposure of Internal API Models (.smd)
This writeup details an Information Disclosure (CWE-200) vulnerability that allowed viewing the source code and complete domain model mapping of a corporate backend.
Censorship Note: All data (domains, paths, URIs, service names, and Java classes) have been strictly anonymized using entirely fictional nomenclature (e.g.,
internal-dashboard.corp.net). This report documents intelligence-gathering mechanics on a JSON-RPC framework within a simulated environment to guarantee 100% privacy for the affected infrastructure.
This writeup details an Information Disclosure (CWE-200) vulnerability that allowed viewing the source code and complete domain model mapping of a corporate backend.
Through the public exposure of .smd (Service Mapping Description) files, an unauthenticated remote attacker could successfully map out over 17,000 internal methods, database queries, and Java class hierarchies, providing a perfect treasure map to escalate attacks.
Vulnerability Analysis
The target utilized a legacy JSON-RPC framework (similar to WaveMaker) that automatically documents backend services so the frontend knows how to communicate with them. This documentation is generated through .smd files.