private keys exposed on the GitHub repository
Medium
Vulnerability Details
## Summary:
When I searched Github for sensitive information I found some privet key in GitHub repository.
these are private RSA key and private server key, which could be used for unauthorized access.
## Steps To Reproduce:
VISIT THESE LINKS:
Repository :
EX:
https://github.com/mcu-tools/mcuboot/blob/137d79717764ed32d5da4b4b301f32f81b2bf40f/enc-x25519-priv.pem
https://github.com/mcu-tools/mcuboot/blob/137d79717764ed32d5da4b4b301f32f81b2bf40f/root-ed25519.pem
(This is just an example)
This is the link that contains it all privet key :-
https://github.com/mcu-tools/mcuboot/search?p=1&q=extension%3Apem+private
## Supporting Material/References:
https://hackerone.com/reports/50170
https://hackerone.com/reports/638401
## Impact
1).Private key leakage
2). All of the servers using this key will be compromised
Actions
View on HackerOneReport Stats
- Report ID: 1234531
- State: Closed
- Substate: informative
- Upvotes: 24