Planet Labs · Report #1639011
Api data leak
Validstatus
mediumseverity
58upvotes
20 Nov 2024disclosed
Summary
A security vulnerability has been identified where sensitive API keys are exposed through archived data accessible via the Wayback Machine (web.archive.org). Some of these API keys are found to be valid and could potentially be exploited by malicious actors. The exposure occurs through historical snapshots of Planet's API endpoints that were cached by the Internet Archive's crawling service.
Steps To Reproduce:
- https://web.archive.org/web/*/https://api.planet.com/* * check this url https://api.planet.com/basemaps/v1/mosaics?api_key=afdb1e8a9c8142739553e3942283d6c8&_page_size=1000 and this https://api.planet.com/basemaps/v1/mosaics/wmts?service=wmts&request=GetCapabilities&format=text%2Fxml&api_key=8fe044edc78c46ba904bb62e550493a3 * can see vaild api kay * this not vaild https://api.planet.com/basemaps/v1/mosaics?api_key=f366791cb438466fb9e3e492e721da8d&_page_size=1000
Impact It can be used to offend
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.