Ian Dunn · Report #1265225
Multiple server ssh usernames leaked in your github repository
N/Astatus
mediumseverity
7upvotes
19 Jul 2021disclosed
How it was found
hi security team,while searching on github,I have found multiple ssh usernames that belongs to your organization are exposed in the organization github repository
STEPS TO REPRODUCE:- 1.Go to this repository. you will see the leaked multiple server ssh usernames. *https://github.com/iandunn/dotfiles/blob/31f4009ddfde9176ba5880687a5119f59183c267/.ssh/config
POC:- I have attached a screenshot.Have a look at this
Impact
By knowing the valid usernames, an attacker can easily bruteforce the password and he can get access to your servers