Rack-Mini-Profiler Environment Information Disclosure

Rack-mini-profiler is a Rails Middleware that displays a page’s speed as a badge. It is intended to work in both production and development environments, however it has been misconfigured on this website, allowing critical information (such as environment variables) to be exposed without authentication.

Environment variables are a set of dynamically named values that can alter how the running processes behave on a computer. An environment variable with a standard name, for example, can provide the location where a computer system stores temporary files, but this can differ from one computer system to the next.

Mitigation / Precaution

In order to patch this vulnerability, it is advised that rack-mini-profiler be disabled or that access to the rack-mini-profiler page be restricted in the production environment.

Written by

Manieendar Mohan

Cyber Security Lead Engineer