Report #42049

Report ID

#42049

Report Type

Websites and Applications

Has PoC

Yes

Target

https://basin.exchange

Impacts

Ability to execute arbitrary system commands

Details

I have discovered that a private key for the service account associated with bean-analytics-data-writer@tbiq-beanstalk-analytics.iam.gserviceaccount.com has been publicly exposed on a GitHub repository. This key grants access to sensitive resources, and it should be rotated immediately to mitigate any potential security risks.

Steps to Reproduce

Visit the URL to see the leaked file: https://github.com/BeanstalkFarms/Beanstalk-Analytics/blob/fedefc69a6cc650988da472dd8bf2172d1efe20a/src_py/tbiq-beanstalk-analytics-bca7893d8291.json#L6

Leaked content:

Impact

The exposed private key poses a significant security threat, as it grants access to critical cloud resources. Unauthorized access to these resources could lead to data loss, service disruption, and unauthorized operations within the project tbiq-beanstalk-analytics.

Actions Taken

I did not perform further testing to avoid inadvertently affecting internal systems or resources. The private key was found to be valid, and it is possible that it may have been compromised.

Fix

Immediate Action: Rotate the exposed private key to prevent unauthorized access.

Proof of Concept

The private key in question was exposed publicly, and I have confirmed its validity by listing the active credentials using the gcloud command:

export GOOGLE_APPLICATION_CREDENTIALS="project.json"
gcloud auth activate-service-account --key-file=project.json
gcloud auth list

Output:

This command confirms that the service account bean-analytics-data-writer@tbiq-beanstalk-analytics.iam.gserviceaccount.com is active and authenticated, validating that the private key is indeed in use. I didn't test it further as it might harm internal settings or systems. Let me know if I need to test it further.