I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. Returning unminified contents.
(856,107): run-time error CSS1036: Expected expression, found '}'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1062: Expected semicolon or closing curly-brace, found '.'
(2353,12): run-time error CSS1038: Expected hex color, found '#fff9'
(2353,17): run-time error CSS1062: Expected semicolon or closing curly-brace, found ' '
*/
/*!
* Bootstrap v3.3.7 (http://getbootstrap.com)
* Copyright 2011-2016 Twitter, Inc.
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)etc.......
The app.css should be accessible knowing that content and css directories are forbidden from server side.
The Question I am searching an answer for:
Does App.Css pose any security threat or issue from information disclosure perspective or can it be considered a vulnerability while published or is it a normal behavior ?
http://dlvr.it/SjGXx1
No comments:
Post a Comment