HexBrain

BlockFi · Report #1134060

credentials found in config file on github

Validstatus
lowseverity
47upvotes
28 Apr 2021disclosed

How it was found

Summary:

Hi, credentials belonging to blockfi.com was found exposed on github, these credentials can lead to attackers gaining access into the network and stealing information and destroying servers

Steps To Reproduce:

https://github.com/paw2py/ETH_API/blob/8658c39d1742f07ac7b5f0e41b82ad164f3ba099/config.py

https://github.com/naboagye-blockfi/ecs-pipeline/blob/38b1417d4dfff624eb6f649d27256758f395aa65/COPY/prometheus/prometheus.yml

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

  • [attachment / reference]

Impact

these credentials can lead to attackers gaining access into the network and stealing information and destroying servers

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original