Description

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T16:18:17.567Z",
  "pubdate": "2026-08-21T16:18:17.567Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Brushfire platform's video content streaming application, specifically accessible via https://online.brushfire.com. The vulnerability allows a remote, unauthenticated attacker to harvest sensitive data by exposing internal database paths in client-facing requests. This flaw impacts data confidentiality, enabling malicious actors to acquire information concerning other platform users without requiring prior authentication or specialized access privileges. The exposure of internal structural application data significantly increases the attack surface, potentially facilitating further targeted exploitation against the system. Remediation for this issue was officially deployed in February 2026.",
  "technicalDetails": "The vulnerability resides within the video content streaming application of the Brushfire platform at https://online.brushfire.com. The root cause stems from improper error handling or excessive debug data exposure during client-server request processing, which inadvertently leaks internal database path information to the end user. Because the application fails to adequately sanitize responses or restrict verbose backend telemetry, remote clients receive structural file system or database location data within standard HTTP traffic.\nThe exploitation vector is completely unauthenticated and network-exposed over standard HTTP/HTTPS protocols. An attacker does not require any pre-existing privileges, internal network positioning, or valid user accounts to initiate an attack. The attack flow involves the adversary intercepting or reviewing standard HTTP requests and responses generated by the video streaming application. By examining the data returned by the server, the attacker identifies exposed database path strings.\nPost-exploitation impact includes the unauthorized gathering of sensitive metadata related to other users of the platform. While the direct extraction of database contents is dictated by the precise path disclosure, the leakage of internal infrastructure architecture provides reconnaissance data that lowers the barrier for advanced attacks, such as targeted SQL injection, local file inclusion, or unauthorized path traversal maneuvers, depending on how the exposed paths are utilized by the underlying database management system and web server configuration."
}