Public Github Repo Leaking Internal Credentials

How it was found

Summary:

In Github I found some credentials to use in a mesos.apache.org Github: https://github.com/Yelp/Tron/blob/master/yelp_package/itest_dockerfiles/mesos/mesos-secrets https://github.com/Yelp/Tron/blob/master/yelp_package/itest_dockerfiles/mesos/mesos-slave-secret

POC ss

{F2021070} {F2021071}

Login documentation https://mesos.apache.org https://mesos.apache.org/documentation/latest/authentication/

Impact

Unauthorized account access /information disclosure