Loading HuntDB...

Private RSA key for Vagrant exposed in GitHub repository

None
S
Sifchain
Submitted None
Reported by sdushantha

Vulnerability Details

Technical details and impact analysis

Insecure Storage of Sensitive Information
## Summary: The private RSA key used for SSH on Vagrant is exposed in sifnode GitHub repository. ## Steps To Reproduce: 1. Visit [this link](https://github.com/Sifchain/sifnode/blob/4fb7523322f74e70600a10fff4dbdd42425c077f/ui/.vagrant/machines/default/virtualbox/private_key) which shows the `private_key` file used for your Vagrant virtual machine ## Suggested solution Remove the private key from the repository. Even though you remove it, it will still be in the commit history. Therefore, refer to the article by GitHub on [removing sensitive data from a repository](https://docs.github.com/en/github/authenticating-to-github/removing-sensitive-data-from-a-repository) ## Impact By having the private SSH key published onto your GitHub repo, an attacker would be able to access your Vagrant virtual machine pretending to be you. The private key has the word "private" for reason and therefore it shouldn't be accessible by unauthorized people.

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Insecure Storage of Sensitive Information