search

NullVoxPopuli / aeonvera

A generic registration system aimed towards swing dance events (mirrored from gitlab)
https://aeonvera.com
GNU Affero General Public License v3.0
15 stars 1 forks source link

Openly index API key found in GIT repo #1212

Open Shaunak-Chatterjee opened 3 years ago

Shaunak-Chatterjee commented 3 years ago

AMAZON_S3_BUCKET

- secure: "qkeYGn2mpgsgU5tKS9GWvFp/utUF/9O8++Shch24DMnq8OB01TrV5QQ2Elj7sSjMWqw2Pbe56nUCA9eOWXhPglGyIq2AI9E0umsEGZxdRlqqobpiMWs5wl8KZ0cFD1rZm6CwfL8atmcNfTt5TnvsaQ2l/k3TerOT2e66R/Mibk8="
# AMAZON_ACCESS_KEY_ID
- secure: "rTYGUFH9SPN0L7QtdE6Liyy/1z7nGKxqDF9LMRsmNsIfsqxoTPKZ8bCctQ4ksuk9svynGQsLfsda5pA+YvuALzjdWmGcID6ENgOGvoFnhZO5LuJ5f6t0k8gFpV9oBquQgDWzhzrcPYvCUrUYg3GSlHjFSXdPdht3SoYn7PiDaNs="
# AMAZON_SECRET_ACCESS_KEY
- secure: "VJ4qiWMzoleLojCcluX+w0RtaFVc9ybRNo6NODkGhHSaao8+4EX4rETBQG67tNSInk1iuNqCcZAGwC8V/12RXdao3PguRSLD5IiKeT+D78dqFEoP0+yHg4PbmZ6TJXADW3gUv/IOqkW7f/UYGinRaPu7hloyiC498FpQdmMWSNI="

Link - https://github.com/NullVoxPopuli/aeonvera/blob/755df8917ee4715c550460fa09cd1d5383588ac6/vendor/bundle/ruby/2.4.0/gems/devise-3.4.1/.travis.yml

Impact - Anyone can steal these and can use them, leading to eating up your usage, causing you to incur losses.

Recommendation - In case you are interested in a permanent fix to this vulnerability, the best way is to revoke the disclosed API keys and generate new keys. If this is done, then even if the API keys are disclosed, an attacker wouldn't be able to use those keys to fetch the valid responses from the API provider service.

It would be great if the bug qualify for any bounty/reward, it requires a lot of hard work to keep going to do such good work.

NullVoxPopuli commented 3 years ago

I appreciate the report <3 but it looks like the key is leaked from a dependency outside my control that has nothing to do with this project that I no longer maintain. I mean, I could update the dependency, but I'm sure the devise folks have rotated keys by now?

Shaunak-Chatterjee commented 3 years ago

It would be better to hide, the key. Because it's not possible to verify except the owner whether they're rotated or not. Unless some black-hat directly utilizes the creds. And for obvious reasons trying such things would be unethical and illegal from my side.

NullVoxPopuli commented 3 years ago

yeah, but the code is managed here: https://gitlab.com/precognition-llc/aeonvera and github is a mirror. unfortunately, I don't have time to deal with every security issue that crops up from old code 😢