Private RSA key and Server key exposed on the GitHub repository
Medium
K
Kubernetes
Submitted None
Actions:
Reported by
njaysec
Vulnerability Details
Technical details and impact analysis
Report Submission Form
## Summary:
I was searching for sensitive data in Kubernetes repository where I found these private keys. These are private RSA key and private server key, which could be used for unauthorized access.
## Steps To Reproduce:
VISIT THESE LINKS
Repository : kubernetes / kubernetes
https://github.com/kubernetes/kubernetes/blob/ce3ddcd5f691b5777e7b2f4d89cac1da316970b4/staging/src/k8s.io/legacy-cloud-providers/vsphere/vclib/fixtures/ca.key
https://github.com/kubernetes/kubernetes/blob/ce3ddcd5f691b5777e7b2f4d89cac1da316970b4/staging/src/k8s.io/legacy-cloud-providers/vsphere/vclib/fixtures/server.key
## Supporting Material/References:
https://hackerone.com/reports/50170
https://hackerone.com/reports/638401
## Impact
1).Private key leakage
2). All of the servers using this key will be compromised
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Cleartext Storage of Sensitive Information