Private RSA key for Vagrant exposed in GitHub repository

Disclosed: 2021-05-07 18:10:47 By sdushantha To sifchain
None
Vulnerability Details
## Summary: The private RSA key used for SSH on Vagrant is exposed in sifnode GitHub repository. ## Steps To Reproduce: 1. Visit [this link](https://github.com/Sifchain/sifnode/blob/4fb7523322f74e70600a10fff4dbdd42425c077f/ui/.vagrant/machines/default/virtualbox/private_key) which shows the `private_key` file used for your Vagrant virtual machine ## Suggested solution Remove the private key from the repository. Even though you remove it, it will still be in the commit history. Therefore, refer to the article by GitHub on [removing sensitive data from a repository](https://docs.github.com/en/github/authenticating-to-github/removing-sensitive-data-from-a-repository) ## Impact By having the private SSH key published onto your GitHub repo, an attacker would be able to access your Vagrant virtual machine pretending to be you. The private key has the word "private" for reason and therefore it shouldn't be accessible by unauthorized people.
Actions
View on HackerOne
Report Stats
  • Report ID: 1183502
  • State: Closed
  • Substate: informative
  • Upvotes: 7
Share this report