U.S. Dept Of Defense · Report #2312609
Full Access to sonarQube and Docker
Summary
This vulnerability involves the exposure of sensitive credentials and IP addresses in a JavaScript file. I gained access to your Hub Docker account and Sonar projects, allowing me to identify and assess the extent of the issue. The vulnerability stems from a JS file within your application that contains hard-coded sensitive credentials, such as usernames, passwords, and potentially API keys. Additionally, it exposes IP addresses associated with your infrastructure. This sensitive information is readily accessible to anyone with access to the file, making it susceptible to unauthorized access and potential misuse.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.