Loading HuntDB...

Private RSA key and Server key exposed on the GitHub repository

Medium
K
Kubernetes
Submitted None
Reported by njaysec

Vulnerability Details

Technical details and impact analysis

Cleartext Storage of Sensitive Information
Report Submission Form ## Summary: I was searching for sensitive data in Kubernetes repository where I found these private keys. These are private RSA key and private server key, which could be used for unauthorized access. ## Steps To Reproduce: VISIT THESE LINKS Repository : kubernetes / kubernetes https://github.com/kubernetes/kubernetes/blob/ce3ddcd5f691b5777e7b2f4d89cac1da316970b4/staging/src/k8s.io/legacy-cloud-providers/vsphere/vclib/fixtures/ca.key https://github.com/kubernetes/kubernetes/blob/ce3ddcd5f691b5777e7b2f4d89cac1da316970b4/staging/src/k8s.io/legacy-cloud-providers/vsphere/vclib/fixtures/server.key ## Supporting Material/References: https://hackerone.com/reports/50170 https://hackerone.com/reports/638401 ## Impact 1).Private key leakage 2). All of the servers using this key will be compromised

Report Details

Additional information and metadata

State

Closed

Substate

Not-Applicable

Submitted

Weakness

Cleartext Storage of Sensitive Information