Loading HuntDB...

Exposed Openapi Token

None
S
Sifchain
Submitted None
Reported by johnjhacking

Vulnerability Details

Technical details and impact analysis

Cleartext Storage of Sensitive Information
**Summary** While looking for secrets, I noticed that Developers had removed a swagger spec draft. The URL had a committed token in the history of multiple project files: ui/core/src/api/transactionsService.ts ui/core/src/api/tendermintService.ts ui/core/src/api/stakingService.ts ui/core/src/api/slashingService.ts ui/core/src/api/sifdistService.ts ui/core/src/api/bankService.ts ...etc, etc **Steps To Reproduce** 1. Look at the file history of the the github ui/core/src/api and check for secrets. I will provide exposed file history if requested further. **Proof** https://raw.githubusercontent.com/Sifchain/sifnode/c1bb5a268da8b519d0fc90f81fa194d31c0f82b3/api/openapi/swagger.yml?token=AAJSXWM6CDXYAEETSC6BJ2S7Q2JLS ## Impact An attacker can utilize the token on the api.sifchain.finance API

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Cleartext Storage of Sensitive Information