Loading HuntDB...

Internal IP addresses range and AWS cluster region leaked in a Github repository

None
K
Kubernetes
Submitted None
Reported by njaysec

Vulnerability Details

Technical details and impact analysis

Insecure Storage of Sensitive Information
Report Submission Form ## Summary: I was exploring the GitHub repository and found some internal IP address and its cluster region related to AWS cluster. So i decided to report it to you. Please have a look and let me know. ## Steps To Reproduce: VISIT THIS LINK : Repository - kubernetes / kubernetes File Link - https://github.com/kubernetes/kubernetes/blob/d4d02a9028337e41b4f7a76e4e7de50067e8529e/cluster/aws/config-default.sh ## Supporting Material/References: Reference: https://hackerone.com/reports/329791 https://hackerone.com/reports/271700 https://hackerone.com/reports/310036 ## Impact 1. These IPs are related to AWS cloud, if someone get enter in the Vnet can also exploit machine on the machines already known. 2. Gives the idea of the organization of internal network. 3. Revealing the AWS cluster region can also narrow down the search of any hacker and make their work easy 4. This will allow attackers to gain access to an internal IP of a DOD website along with other sensitive information that may be leaked with the request

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Insecure Storage of Sensitive Information