HexBrain

U.S. Dept Of Defense · Report #2312609

Full Access to sonarQube and Docker

Validstatus
criticalseverity
21upvotes
22 Mar 2024disclosed

Summary

This vulnerability involves the exposure of sensitive credentials and IP addresses in a JavaScript file. I gained access to your Hub Docker account and Sonar projects, allowing me to identify and assess the extent of the issue. The vulnerability stems from a JS file within your application that contains hard-coded sensitive credentials, such as usernames, passwords, and potentially API keys. Additionally, it exposes IP addresses associated with your infrastructure. This sensitive information is readily accessible to anyone with access to the file, making it susceptible to unauthorized access and potential misuse.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original