two aws access key and secret key and database username and password exposed
Team Summary
Official summary from Mozilla
A security vulnerability is identified in a Docker image hosted on Docker Hub. The image, associated with Mozilla's Common Voice project, is found to contain exposed AWS access keys, AWS secret keys, and database credentials. These sensitive credentials are discovered within the file /code/scripts/test/config.json of the Docker image and allowed unauthorized access to AWS resources associated with the project. The images were deleted from docker hub, the credentials were rotated and the AWS users associated with them were removed. Note that Common Voice is out of scope of our program but we accepted and rewarded this report since it is critical.
Vulnerability Details
Technical details and impact analysis
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure