Cleartext Storage of Sensitive Information

Summary

A security vulnerability has been identified in Mautic that allows direct access to sensitive ".env" configuration files through a web browser. This issue can lead to the disclosure of critical information, including database credentials, API keys, and other sensitive system configurations. The root cause is a lack of proper web server configuration to restrict access to .env files, making it possible for unauthenticated attackers to view their contents simply by accessing the file's URL. To mitigate this vulnerability, users should update to one of the fixed versions. Although Mautic does not use ".env" files for production data by default, it is important to secure these files at the web server level. Apache users should ensure their server is configured to respect ".htaccess files", which typically block access to such sensitive files. Nginx users, on the other hand, must manually add a configuration block to deny access by including the directive location "~ /\.env { deny all; }" in their Nginx configuration for the Mautic site. After applying this configuration, the Nginx service must be reloaded or restarted for the changes to take effect. This vulnerability affects Mautic versions 4.4.0-beta through 5.2.5, and 6.0.0-alpha through 6.0.1.