地图 / A password in plain text in conf file

A password in plain text in conf file

信息泄露 / Password in Configuration File / #1188188

厂商: Sifchain
严重程度: 未评级
赏金: —
弱点: Password in Configuration File
研究员: @nouradeen
披露日期: 2021-05-07
资产: https://github.com/sifchain/sifnode
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（218 字符中的一小部分）

I found a password in plain text in \sifnode-develop\ui\e2e\config.js in the source code. password: "coolguy21"

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Sifchain 所有。

时间线

2021-05-07报告提交
2021-05-07公开披露

阅读 HackerOne 原文 ↗作者 @nouradeen · 版权归作者与 Sifchain 所有

同类报告

MySQL username and password leaked in developer.valvesoftware.com via source code dislosureValve · 2018-05-07 Insecure Zendesk SSO implementation by generating JWT client-sideTrint Ltd · 2019-09-08 credentials found in config file on githubBlockFi · 2021-04-28 Access to SQL server of ubergreen.pt through password disclosure from different domain on same IPUber · 2021-03-15 · $750 MySQL username and password leaked on [2017.russianaicup.ru]Mail.ru · — · $150 Git repo on https://██████.mil/ discloses API passwordU.S. Dept Of Defense · 2021-03-24