Sifchain · Report #1183809
mongodb credentials leaked in github
N/Astatus
1upvotes
7 May 2021disclosed
How it was found
Steps To Reproduce:
[add details for how we can reproduce the issue]
- Go to values.yaml file file.
2.Check from line 23:
blockExplorer:
args:
mongoUsername: "mongodb"
mongoPassword:
mongoDatabase: "block_explorer"
env:
rootURL: "http://localhost:3000"
chainnet: ""
genesisURL: ""
remote:
rpcURL: ""
apiURL: ""
{F1288433}
Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
- [attachment / reference] F1288433
Impact
I believe that this database has the data of https://blockexplorer.sifchain.finance/blocks ,so an attacker can access the database and control it.