Credentials leaked via Github

Disclosed: 2024-08-26 15:35:35 By sheikh_chilli To acronis
Medium
Vulnerability Details
Hi Team, I have found the credentials on Github which leads to direct access to the portal. Steps to reproduce: Go to the below link: https://github.com/MasterHimself/Test/blob/2faa2990fe2d63ceb8b1577df792e0edc5d0bdba/Selenium/Behave/Examples/Steps/Steps.py Observed the hardcoded credentials. So, I visit the URL https://cloud.acronis.com/login & use the mentioned credentials. driver.find_element_by_xpath("//input[@name='login']").█████ driver.find_element_by_xpath("//input[@name='password']").█████ Got the direct access and able to view the sensitive information. ## Impact Hardcoded passwords are particularly dangerous because they are easy targets for password guessing exploits, allowing hackers and malware to hijack firmware, devices (such as health monitoring equipment), systems, and software. Looking forward to your response. regards Alisha Sheikh
Actions
View on HackerOne
Report Stats
  • Report ID: 1078373
  • State: Closed
  • Substate: resolved
  • Upvotes: 23
Share this report