Loading HuntDB...

CI for [example.gov] can be logged in and accessible

Critical
G
GSA Bounty
Submitted None

Team Summary

Official summary from GSA Bounty

When anyone searched a public search engine for `inurl:example.gov` (where `example.gov` was one of the URLs in the TTS Bug Bounty scope), the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in", no authentication was required. This exposed the CI/CD interface for a production component, including a set of deployment credentials. It would have been possible to leverage these credentials to get other privileges.

Reported by kunal94

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$2000.00

Submitted

Weakness

Improper Access Control - Generic