CVE-2023-4168

Executive Summary

CVE-2023-4168 is a critical information disclosure vulnerability in Templatecookie Adlisting version 2.14.0. The flaw resides in the redirect handler of the /ad-list endpoint, where sensitive configuration data—including Google Maps API keys, Firebase server keys, and application IDs—is leaked in the HTTP response body. An unauthenticated remote attacker can exploit this by sending a crafted GET request to the vulnerable endpoint, exposing credentials that could compromise integrated third-party services. The vendor was contacted but did not respond, leaving the software unpatched. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is trivial to exploit, with public proof-of-concept code available.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a standalone PHP web application. The supply chain risk is limited to direct deployment of the Adlisting script. However, the leaked credentials (e.g., Firebase API keys) could be used to access cloud services associated with the application, potentially leading to broader compromise of the hosting environment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and public exploit code exists. The leaked credentials (Google Maps API key, Firebase server key) can be used to incur financial costs, access sensitive data, or pivot to other services.

Deep Dive & Mechanics

The vulnerability originates from the application's redirect handler, which processes requests to /ad-list and /ad-list-search endpoints. When a request is made with specific query parameters (e.g., keyword, lat, long, location, category), the server responds with an HTTP 200 status and an HTML page. However, the response body inadvertently includes JavaScript configuration objects containing hardcoded credentials.

The leaked data includes:

• google_map_key: Google Maps API key
• api_key: Firebase Web API key
• auth_domain: Firebase authentication domain
• project_id: Firebase project ID
• storage_bucket: Firebase storage bucket
• messaging_sender_id: Firebase messaging sender ID
• app_id: Firebase app ID
• measurement_id: Google Analytics measurement ID

These credentials are typically stored in client-side JavaScript files (e.g., firebaseConfig) and are exposed because the redirect handler does not sanitize the response body. The attack is triggered by sending a GET request to a URL like:

/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=

The server returns the full HTML page, including the configuration block, which is visible in the response body.

Vulnerable vs. Patched Code

Vulnerable Code (Adlisting 2.14.0): The application includes hardcoded Firebase and Google Maps configuration in a JavaScript block within the HTML response. Example snippet from the response body:

<script>
  var firebaseConfig = {
    apiKey: "AIzaSy...",
    authDomain: "example.firebaseapp.com",
    projectId: "example-12345",
    storageBucket: "example.appspot.com",
    messagingSenderId: "123456789",
    appId: "1:123456789:web:abc123",
    measurementId: "G-ABC123"
  };
  var google_map_key = "AIzaSy...";
</script>

Patched Code (Hypothetical): A patched version would remove hardcoded credentials from client-side code and instead fetch them server-side via environment variables or a secure API endpoint. Example:

<script>
  fetch('/api/config')
    .then(response => response.json())
    .then(config => {
      // Initialize Firebase with server-provided config
      firebase.initializeApp(config);
    });
</script>

The server-side endpoint would validate the request and return credentials only to authenticated users or trusted origins.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Adlisting 2.14.0
• Network access to the target web server

Steps:

1. Send a GET request to the vulnerable endpoint:

   curl -v "http://target.com/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword="
   

2. Examine the response body for the JavaScript configuration block containing google_map_key, api_key, auth_domain, etc.
3. Extract the leaked credentials and use them to access Firebase or Google Maps services.

Exploit-DB Code (Provided): The following exploit code demonstrates the vulnerability:

# Exploit Title: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
# Exploit Author: CraCkEr
# Date: 25/07/2023
# Vendor: Templatecookie
# Vendor Homepage: https://templatecookie.com/
# Software Link: https://templatecookie.com/demo/adlisting-classified-ads-script
# Version: 2.14.0
# Tested on: Windows 10 Pro
# Impact: Sensitive Information Leakage
# CVE: CVE-2023-4168

## Description
Information disclosure issue in the redirect responses, When accessing any page on the website,
Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.

## Steps to Reproduce:
When you visit any page on the website, like:
https://website/ad-list?category=electronics
https://website/ad-list-search?page=2
https://website/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=

in the body page response there's information leakage for
+---------------------+
google_map_key
api_key
auth_domain
project_id
storage_bucket
messaging_sender_id
app_id
measurement_id
+---------------------+

Note: The same information leaked, such as the API keys, server keys, and app ID, was added to the "Firebase Push Notification Configuration" in the Administration Panel.
Settings of "Firebase Push Notification Configuration" in the Administration Panel, on this Path:
https://website/push-notification (Login as Administrator)
[-] Done

Usage: The exploit is manual; simply visit the listed URLs and inspect the page source. Automated tools like cURL or Burp Suite can be used to extract the data.

Blue Team (Detection & Response)

Detection:

• Monitor HTTP responses for the presence of google_map_key, api_key, or firebaseConfig in the body.
• Alert on requests to /ad-list-search with multiple empty query parameters (e.g., keyword=&lat=&long=).
• Use WAF rules to block requests with suspicious query strings.

Response:

1. Immediately rotate all leaked API keys and Firebase credentials.
2. Remove hardcoded credentials from the application code and implement server-side configuration.
3. Apply a virtual patch using a WAF to block exploitation attempts.
4. Conduct a security audit to identify other hardcoded secrets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ad-list-search with query parameters containing empty values (e.g., keyword=&lat=&long=&long=&lat=&location=&category=&keyword=)
  • HTTP responses containing google_map_key, api_key, auth_domain, project_id, storage_bucket, messaging_sender_id, app_id, measurement_id
• File IOCs:
  • JavaScript files containing hardcoded Firebase configuration objects
• Behavioral IOCs:
  • Unauthorized access to Firebase or Google Maps APIs using leaked keys
  • Unexpected API usage spikes from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2023_4168_Adlisting_InfoDisclosure {
    meta:
        description = "Detects hardcoded Firebase and Google Maps credentials in Adlisting 2.14.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-4168"
    strings:
        $firebase_config = "firebaseConfig" ascii wide nocase
        $google_map_key = "google_map_key" ascii wide nocase
        $api_key = "apiKey" ascii wide nocase
        $auth_domain = "authDomain" ascii wide nocase
        $project_id = "projectId" ascii wide nocase
        $storage_bucket = "storageBucket" ascii wide nocase
        $messaging_sender_id = "messagingSenderId" ascii wide nocase
        $app_id = "appId" ascii wide nocase
        $measurement_id = "measurementId" ascii wide nocase
    condition:
        any of ($firebase_config, $google_map_key) and
        any of ($api_key, $auth_domain, $project_id, $storage_bucket, $messaging_sender_id, $app_id, $measurement_id)
}

Sigma Rule

title: CVE-2023-4168 Adlisting Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing hardcoded Firebase and Google Maps credentials from Adlisting 2.14.0
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4168
    - https://www.exploit-db.com/exploits/51667
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.response.body|contains:
            - 'google_map_key'
            - 'apiKey'
            - 'authDomain'
            - 'projectId'
            - 'storageBucket'
            - 'messagingSenderId'
            - 'appId'
            - 'measurementId'
    condition: selection
falsepositives:
    - Legitimate use of Firebase SDK with hardcoded keys (should be avoided)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-4168 Adlisting Information Disclosure"; flow:to_server,established; content:"/ad-list-search"; http_uri; content:"keyword="; http_uri; content:"&lat="; http_uri; content:"&long="; http_uri; pcre:"/google_map_key|apiKey|authDomain|projectId|storageBucket|messagingSenderId|appId|measurementId/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-4168

info:
  name: Adlisting Classified Ads 2.14.0 - Information Disclosure
  author: r3Y3r53
  severity: high
  description: |
    Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.
  impact: |
    Unauthenticated attackers can access sensitive API keys, server keys, and app IDs exposed in redirect responses, potentially compromising integrated third-party services and the Google Maps API used by the classified ads platform.
  remediation: |
    Update Adlisting to a version newer than 2.14.0 that removes sensitive credentials from client-side code and stores API keys securely on the server side.
  reference:
    - https://www.exploit-db.com/exploits/51667
    - https://templatecookie.com/demo/adlisting-classified-ads-script
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4168
    - https://vuldb.com/?ctiid.236184
    - https://vuldb.com/?id.236184
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-4168
    cwe-id: CWE-200,NVD-CWE-noinfo
    epss-score: 0.74653
    epss-percentile: 0.98869
    cpe: cpe:2.3:a:templatecookie:adlisting:2.14.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: templatecookie
    product: adlisting
  tags: cve,cve2023,adlisting,exposure,templatecookie,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword="

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "google_map_key", "api_key", "auth_domain")'
        condition: and
# digest: 4b0a00483046022100a6b7256606089a673c119eca85dd2545bc11c42c12d41e52cb89911fa2718e91022100e87c9be96b4689f903d85038601d049821845ceda0514f6ae259d860bc3e87b6:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Rotate Credentials: Revoke and regenerate all leaked API keys (Google Maps, Firebase) immediately.
2. Virtual Patching: Deploy a WAF rule to block requests to /ad-list-search with empty query parameters.
3. Code Fix: Remove hardcoded credentials from client-side JavaScript. Implement server-side configuration retrieval via environment variables or a secure API endpoint.
4. Update: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.

Long-Term Recommendations:

• Conduct a full security audit of the application for other hardcoded secrets.
• Implement a secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager).
• Enforce secure coding practices: never expose API keys in client-side code.
• Monitor for unauthorized use of leaked credentials via cloud provider logs.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 8DFA714492F0F96A0163F046] */}