1549918 - RCE @ mozilla autopush

Status: RESOLVED INVALID

(Websites :: Other, task)

Description

[John]

AWS credentials:
adm_creds = json.dumps({
"dev":
{
"app_id": "amzn1.application.StringOfStuff",
"client_id": "amzn1.application-oa2-client.ev4nM0reStuff",
"client_secret": "deadbeef0000decafbad1111"
}
})

@https://github.com/mozilla-services/autopush/blob/cf9b86d823e4b5d82ee0e199248870f39a00b22e/autopush/tests/test_z_main.py

Comment 1

[Greg G]

Thanks for looking at this Johnathan.

https://github.com/mozilla-services/autopush/blob/cf9b86d823e4b5d82ee0e199248870f39a00b22e/autopush/tests/test_z_main.py#L314-L321 are placeholder creds. Amazon API keys start with AKIA https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys

Comment 2

[John]

I think you can generate access token with these:
https://developer.amazon.com/docs/amazon-drive/ad-restful-api-getting-started.html#authorization-code-grant

Comment 3

[Greg G]

(In reply to Johnathan Simon from comment #2)

I think you can generate access token with these:
https://developer.amazon.com/docs/amazon-drive/ad-restful-api-getting-started.html#authorization-code-grant

True, I don't think they're valid though. We'd be interested if you're able to use them to generate working creds.