1679181 - Private Key Disclosure in Telemetry-airflow repository of Mozilla github account.

Status: RESOLVED INVALID

(Websites :: Other, defect)

Description

[puranjanprithu]

I used git grabber tool to search github for private api keys .
On the mozilla github account , i found a website which disclose Google Cloud Service Account credentials on its Telemetry-airflow repo.

Steps to reproduce:
Visit the following url-->
https://raw.githubusercontent.com/mozilla/telemetry-airflow/236b6feacfc4d29bfcd60ad0e2805ef55169e96c/bin/run

Repository URL : https://github.com/mozilla/telemetry-airflow
Commit (7 days ago) : 2020-11-13T19:04:30Z by [e-mail]

Comment 1

[Greg G]

Thanks for the report! Can you confirm whether the creds are valid and have access to anything?

The client_email is [e-mail], so they shouldn't have access to anything.

Comment 2

[Greg G]

ascholtz: can you confirm that this is a dev key without access to GCP resources?

Comment 3

[Greg G]

Can confirm the creds are public at the reported URL.

Comment 4

[Anna Scholtz [:ascholtz]]

Looks like they have been added in https://github.com/mozilla/telemetry-airflow/pull/670
amiyaguchi: can probably clarify whether they have access to any GCP resources.

Comment 5

[Anthony Miyaguchi [:amiyaguchi]]

I can confirm that this is a fake key that is used to satisfy Airflow startup requirements. It does not map to GCP resources given the project id and service account name, though I forget the original method used to generate the keys.