Closed
Bug 1497853
Opened 7 years ago
Closed 7 years ago
Credentials for Balrog 2.0 Admin interface Disclosed
Categories
(Release Engineering Graveyard :: Applications: Balrog (backend), defect)
Release Engineering Graveyard
Applications: Balrog (backend)
Tracking
(Not tracked)
RESOLVED
WONTFIX
People
(Reporter: dtm, Assigned: catlee)
References
Details
(Keywords: reporter-external, Whiteboard: [reporter-external] [web-bounty-form] [verif?])
Attachments
(1 file)
|
404.35 KB,
image/png
|
Details |
Credentials validated for Balrog admin interface
The credentials for Balrog 2.0 Admin interface appear to have been disclosed in a public security audit report [1]. The credentials were identified within screenshots on pages 28 (and 30).
YmhlYXJzdW1AbW96aWxsYS5jb206YXdlcm9hd2Vy
YmFscm9nYWRtaW46YmFscm9nYWRtaW4=
bhearsum@mozilla.com:aweroawer
balrogadmin:balrogadmin
I initially emailed about this but since seeing Mozilla participates in a bug bounty I validated the first set of credentials.
Screenshot attached.
[1] https://drive.google.com/file/d/1v53GCYPxzoZmB1dCop1yJfZgS1wi64dS/view
Flags: sec-bounty?
|
||
Comment 2•7 years ago
|
||
Good catch! Those credentials are for a dev site that has no real privilege, but it's bad practice anyway. We'll get them changes, and thanks for the report.
Assignee: nobody → catlee
Group: websites-security → releng-security
Status: UNCONFIRMED → ASSIGNED
Component: Other → Applications: Balrog (backend)
Ever confirmed: true
Product: Websites → Release Engineering
QA Contact: bhearsum
|
|
||
Comment 3•7 years ago
|
||
Actually you can supply _any_ credentials to that site - a space for a username and the password works just as well :)
Pretty sure thats completely intentional but will check.
|
|
||
Comment 4•7 years ago
|
||
As Simon mentioned, this is intentional. https://bugzilla.mozilla.org/show_bug.cgi?id=1324813
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
|
||
Comment 5•7 years ago
|
||
Given that bug 1324813 is already public, lifting sec flags on this bug.
Group: releng-security
|
||
Updated•7 years ago
|
Flags: sec-bounty? → sec-bounty-
|
||
Updated•5 years ago
|
Product: Release Engineering → Release Engineering Graveyard
|
||
Updated•1 year ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•