A critical information disclosure vulnerability in 4C Strategies Exonaut 21.6 allows unauthenticated attackers to potentially access sensitive data via external HTTPS requests.

This vulnerability involves an information disclosure flaw within the ExonautWeb component, allowing an unauthenticated attacker to extract sensitive information through a specifically crafted external HTTPS request.

The ability for an unauthenticated user to remotely disclose sensitive information poses a significant risk to organizational confidentiality. Given the CVSS score of 7.5, this high severity vulnerability could facilitate unauthorized access to proprietary data or system configurations, potentially leading to further exploitation or regulatory compliance failures.

Immediate Action: Review the vendor advisory for 4C Strategies to determine if a patch or configuration update is available for version 21.6 and apply it immediately.

Proactive Monitoring: Monitor server access logs for anomalous HTTPS requests originating from external sources that target the ExonautWeb interface.

Compensating Controls: Implement strict network ingress filtering or use a Web Application Firewall (WAF) to block suspicious or unauthorized external requests directed at the application until a permanent fix is deployed.

Public Exploit Available: Yes — a proof-of-concept is documented in a public GitHub Gist.

The presence of a public proof-of-concept for this information disclosure vulnerability necessitates an urgent response. Organizations running 4C Strategies Exonaut 21.6 should prioritize this issue in their patch cycle and verify their exposure by reviewing network logs for suspicious external traffic patterns.