HexBrain

MTN Group · Report #1351329

firebase credentials leaks @ https://mpulse.mtnonline.com

Validstatus
mediumseverity
12upvotes
5 Sept 2022disclosed

How it was found

Summary:

Hello. I found firebase credentials leaks at https://mpulse.mtnonline.com

Steps To Reproduce:

Visit https://mpulse.mtnonline.com >> right click >> view source code

Supporting Material/References:

<!-- Firebase -->
<!-- <script>
// Initialize Firebase
var config = {
apiKey: "████",
authDomain: "████████",
databaseURL: "https://mpulse-25c68.firebaseio.com",
projectId: "mpulse-25c68",
storageBucket: "mpulse-25c68.appspot.com",
messagingSenderId: "295133444438"
};
firebase.initializeApp(config);
</script> -->

Impact

Un authorize access to firebase database.

Kind regard @aliyugombe

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original