HexBrain

Ian Dunn · Report #1265225

Multiple server ssh usernames leaked in your github repository

N/Astatus
mediumseverity
7upvotes
19 Jul 2021disclosed

How it was found

hi security team,while searching on github,I have found multiple ssh usernames that belongs to your organization are exposed in the organization github repository

STEPS TO REPRODUCE:- 1.Go to this repository. you will see the leaked multiple server ssh usernames. *https://github.com/iandunn/dotfiles/blob/31f4009ddfde9176ba5880687a5119f59183c267/.ssh/config

POC:- I have attached a screenshot.Have a look at this

Impact

By knowing the valid usernames, an attacker can easily bruteforce the password and he can get access to your servers

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original