Credentials leaked via Github
Medium
Vulnerability Details
Hi Team,
I have found the credentials on Github which leads to direct access to the portal.
Steps to reproduce:
Go to the below link: https://github.com/MasterHimself/Test/blob/2faa2990fe2d63ceb8b1577df792e0edc5d0bdba/Selenium/Behave/Examples/Steps/Steps.py
Observed the hardcoded credentials.
So, I visit the URL https://cloud.acronis.com/login & use the mentioned credentials.
driver.find_element_by_xpath("//input[@name='login']").█████
driver.find_element_by_xpath("//input[@name='password']").█████
Got the direct access and able to view the sensitive information.
## Impact
Hardcoded passwords are particularly dangerous because they are easy targets for password guessing exploits, allowing hackers and malware to hijack firmware, devices (such as health monitoring equipment), systems, and software.
Looking forward to your response.
regards
Alisha Sheikh
Actions
View on HackerOneReport Stats
- Report ID: 1078373
- State: Closed
- Substate: resolved
- Upvotes: 23