Rack-Mini-Profiler Environment Information Disclosure

Manieendar Mohan
Published on
01 Oct 2021

Rack-mini-profiler is a Rails Middleware that displays a page’s speed as a badge. It is intended to work in both production and development environments, however it has been misconfigured on this website, allowing critical information (such as environment variables) to be exposed without authentication.

Environment variables are a set of dynamically named values that can alter how the running processes behave on a computer. An environment variable with a standard name, for example, can provide the location where a computer system stores temporary files, but this can differ from one computer system to the next.

Mitigation / Precaution

In order to patch this vulnerability, it is advised that rack-mini-profiler be disabled or that access to the rack-mini-profiler page be restricted in the production environment.

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Manieendar Mohan
Manieendar Mohan
Cyber Security Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment