CI for [example.gov] can be logged in and accessible
Critical
G
GSA Bounty
Submitted None
Team Summary
Official summary from GSA Bounty
When anyone searched a public search engine for `inurl:example.gov` (where `example.gov` was one of the URLs in the TTS Bug Bounty scope), the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in", no authentication was required. This exposed the CI/CD interface for a production component, including a set of deployment credentials. It would have been possible to leverage these credentials to get other privileges.
Actions:
Reported by
kunal94
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$2000.00
Submitted
Weakness
Improper Access Control - Generic