HexBrain

Sifchain · Report #1183809

mongodb credentials leaked in github

N/Astatus
1upvotes
7 May 2021disclosed

How it was found

Steps To Reproduce:

[add details for how we can reproduce the issue]

  1. Go to values.yaml file file.

2.Check from line 23:

blockExplorer:
  args:
    mongoUsername: "mongodb"
    mongoPassword:
    mongoDatabase: "block_explorer"
  env:
    rootURL: "http://localhost:3000"
    chainnet: ""
    genesisURL: ""
    remote:
      rpcURL: ""
      apiURL: ""

{F1288433}

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

  • [attachment / reference] F1288433

Impact

I believe that this database has the data of https://blockexplorer.sifchain.finance/blocks ,so an attacker can access the database and control it.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original