Information Disclosure Vulnerability in Bruno

The BSI has reported an information disclosure vulnerability affecting the Bruno API client. This flaw allows a remote, unauthenticated attacker to access sensitive information that should be protected. Given that Bruno is a desktop-based API client frequently used to store collections, environment variables, and authentication tokens, successful exploitation could lead to the exposure of credentials, API keys, and sensitive configuration data. Defenders should prioritize identifying instances of Bruno within their environment and monitoring for unexpected access patterns to application-associated files, specifically those storing project collections and environment settings.

Impact

Successful exploitation results in the unauthorized exposure of sensitive application data, including API collections and authentication secrets stored within the Bruno client. This could facilitate further unauthorized access to internal services or third-party APIs used by the affected organization.

Recommendation

• Identify all instances of the Bruno desktop application across the enterprise environment.
• Review and restrict access permissions to folders where Bruno stores project data, typically within user home directories.
• Monitor for unauthorized access to configuration files and collection JSON files managed by the application.
• Coordinate with users to ensure the application is updated to the latest available version provided by the vendor.