sentry Auth Token exposed publicly in docker hub image

Disclosed: 2024-10-18 10:50:15 By ghaazy To mozilla
None
Vulnerability Details
## Summary: Hi during my recon I found Sentry token which belongs to taskcluster The token is still active. ## Steps 1. Go to https://hub.docker.com/r/taskcluster/taskcluster/tags 2. pull these images tags ```v15.0.0-20-g0eca18b7c``` and ``` c061025dc``` and ```ba7958766``` and ```v16.2.0-77-gd8577f62a``` may be this exist in more tags 3. You will see this token 5841673fc43843db98088d579568271bcee388b21d91455b9c1fb151bab260b9 in /app/node_modules/sentry-api/test.js 4. Try using the token with below curl request curl -X GET -H "Authorization: Bearer 5841673fc43843db98088d579568271bcee388b21d91455b9c1fb151bab260b9" https://sentry.io/api/0/projects/ 5. You will see api response. {F3113306} ## Supporting Material/References: * https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/sensitive-data-exposure-sentry-auth-token/ ## Impact ## Summary: Sentry exposes logs of the application which can contain sensitive information and PII. This is basic impact. But sentry contains application logs it can be used to find more vulnerabilities in the code base
Actions
View on HackerOne
Report Stats
  • Report ID: 2412983
  • State: Closed
  • Substate: resolved
  • Upvotes: 42
Share this report