Starbucks · Report #716292
JumpCloud API Key leaked via Open Github Repository.
Validstatus
criticalseverity
739upvotes
30 Dec 2019disclosed
Summary
vinothkumar discovered a publicly available Github repository containing a Starbucks JumpCloud API Key which provided access to internal system information.
@vinothkumar — thank you for reporting this vulnerability and confirming the resolution.
How it was found
Summary: Open Github Repo Leaking Starbucks JumbCloud API Key
Description: Team,
While going through Github search I discovered a public repository which contains Jumbcloud API Key of Starbucks.
Repo: https://github.com/██████████/Project. File: https://github.com/████/Project/blob/0d56bb910923da2fbee95971778923f734a25f68/getSystemUsers.go
req.Header.Add("x-api-key", "████████")
POC
- List systems ``` curl -H "x-api-key: ████████" "https://console.jumpcloud.com/api/systems"
* ```
curl -H "x-api-key: █████" "https://console.jumpcloud.com/api/systemusers"
- SSO Applications ```curl -H "x-api-key: ██████" "https://console.jumpcloud.com/api/applications"
## Impact
This issue impact is critical as through this API anyone could
* Execute commands on systems [https://docs.jumpcloud.com/1.0/commands/create-a-command](https://docs.jumpcloud.com/1.0/commands/create-a-command)
* Add/Remove users which has access to internal systems
* AWS Account Takeover