API key (api.semrush.com) leak in JS-file

Summary

The researcher found a javascript file with an API token that allowed to get internal statistics.

When you access a page not found on the application, the source code of the page contains a portion of code that list a lot of javascript files. Some of these javascript files correspond to the Semrush internal interface, including some that display the internal statistics of Semrush’s systems. These publicly accessible javascript files contained an internal API token that allowed access to internal statistics of Semrush’s systems.