UIES - Security Audit

Security audit report

Target: app.example-client.com  ยท  Date: 2026-10-06 09:58

Risk score

40/100
HIGH
Executive summary
We ran a security audit of the client's web application. The most serious finding is a publicly accessible configuration file with access credentials - it needs immediate action (block access and rotate the passwords). Beyond that: an outdated server with known vulnerabilities and a CORS misconfiguration in the API, to fix next, plus minor gaps (SPF/DMARC, headers). On the plus side: login correctly blocks dictionary attacks. Recommendations and priorities sit with each finding; we are happy to run a repeat audit after the fixes.

Summary

0CRITICAL
1HIGH
2MEDIUM
3LOW
1GOOD
3INFO

Findings

HIGH

Exposed configuration file (.env)

content
CVSS 7.5A05:2021 Security MisconfigurationCWE-538
Description
The .env file was publicly accessible and contained database credentials and API keys.
Evidence
GET https://app.example-client.com/.env -> 200 DB_PASSWORD=*** (masked in the report)
Recommendation
Block access to configuration files on the server and immediately rotate the exposed passwords and keys.
Reference
https://owasp.org/www-project-secure-headers/
Analyst comment
Confirmed manually: the file really did contain working credentials. Priority 1 - block and rotate before anything else.
MEDIUM

Outdated server with known vulnerabilities

cve_map
CVSS 6.5CWE-1035
Description
The server software version has publicly known vulnerabilities (CVEs).
Evidence
nginx 1.18.0 -> incl. CVE-2021-23017 (CVSS 7.3)
Recommendation
Update the server to a version free of the listed CVEs.
MEDIUM

CORS reflects any Origin

web
CVSS 5.0A05:2021 Security MisconfigurationCWE-942
Description
The server reflects the supplied Origin. The risk depends on the sensitivity of the data returned by the API.
Recommendation
Restrict Access-Control-Allow-Origin to trusted domains.
LOW

Missing SPF record

dns_mail
A05:2021 Security Misconfiguration
Description
A missing SPF record makes it easier to spoof the domain in e-mail.
Recommendation
Add a TXT record v=spf1 ... -all.
LOW

Missing DMARC record

dns_mail
Description
No DMARC - no enforcement of an anti-spoofing policy.
Recommendation
Add _dmarc TXT v=DMARC1; p=reject.
LOW

Missing security headers

web
A05:2021 Security Misconfiguration
Description
Recommended HTTP headers are missing (CSP, X-Frame-Options, nosniff, Referrer-Policy).
Recommendation
Add the missing headers on the server or reverse proxy.
Reference
https://owasp.org/www-project-secure-headers/
GOOD

Login resists dictionary attacks

active_bruteforce
Description
After a run of failed attempts the server locked out further logins (lockout). The control works correctly.
INFO

Open port 443/tcp - https

discovery
Evidence
443/tcp https nginx
INFO

Detected technologies

web
Evidence
nginx, PHP, jQuery, Bootstrap
INFO

Mapped 37 endpoints

crawl
Evidence
/, /login, /api, /panel, /uploads ... (list truncated)

Raw tool logs

nmap.txt
$ nmap -sV app.example-client.com
PORT     STATE SERVICE
443/tcp  open  https nginx
(excerpt, anonymized)

Assessment carried out with the written consent of the target's owner. Report confidential. A "GOOD" result means a control working correctly.