Space and defense tech maker Exail Technologies exposes database access

Exail Technologies, a high-tech manufacturer whose clients include the US Coast Guard, exposed sensitive company data that could’ve enabled attackers to access its databases.

Exail, a French high-tech industrial group, left exposed a publicly accessible environment (.env) file with database credentials, the Cybernews research team has discovered.

The company, formed in 2022 after ECA Group and iXblue merged, specializes in robotics, maritime, navigation, aerospace, and photonics technologies, making it a particularly juicy target for attackers.

The company fixed the issue after being contacted by our research team. We reached out to Exail for further comment but did not receive a response before publishing.

What Exail data was exposed?

The publicly accessible .env file, hosted on the exail.com website, was exposed to the internet, meaning that anyone could have accessed it.

An environment file serves as a set of instructions for computer programs. Therefore, leaving the file open to anyone might expose critical data and provide threat actors with an array of options for attacking.

According to the team, Exail’s exposed .env file contained database credentials. If the database would have been open to the public, attackers could have used the credentials to access the company’s data. However, in this case, it was not open to the public.

“Once inside, attackers could view, modify, or delete sensitive data and execute unauthorized operations. The publicly hosted environment was exposed to the internet, meaning that anyone could’ve used these credentials to access sensitive information stored in this database,” researchers explained.

Dangerous flavors

According to the team, Exail’s web server version and operating system (OS) flavor were also jeopardized. OS flavor refers to a unique system version with specific features, configurations, software packages, and other specifications.

Exposing this type of data poses a wide array of dangers. Different OSs have specific sets of vulnerabilities, such as unpatched security flaws, default configurations, and known weaknesses.

“If a malicious actor is aware of the OS flavor and version running on the web server, they could target specific vulnerabilities associated with the OS,” researchers said.

Additionally, an exposed web server with known OS flavors could become a target for automated scanning tools, malware, and botnets.

“Once an attacker knows the OS flavor, they can focus their efforts on finding and exploiting vulnerabilities specifically associated with that OS. They can employ techniques like scanning, proving, or using known exploits to gain access to the server or compromise its security,” the team explained.

The attackers could also leverage OS-specific weaknesses to launch denial of service (DoS) attacks against the exposed web server and overwhelm it with a flood of requests, disrupting the server’s operations.

If you want to know more about recommendations provided by CyberNEws to Exail take a look at the original post on CyberNews:

https://cybernews.com/security/exail-technologies-expose-database-access/

About the author: Vilius Petkauskas, Deputy Editor at CyberNews

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Exail Technologies)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.