Summary: Can you imagine discovering an API key disclosure vulnerability in a disclosed API key disclosure report? The same thing is what I came across while going through the disclosed reports at Stripo Inc. Plus, the disclosed API key isn't even revoked, and therefore I am still able to use the same API key to fetch response from the target. I am talking about #983331 where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys from Aviary and YouTube are disclosed in that report, and I tried using these API keys, and found out that they can still be used to fetch response from YouTube's API using Stripo's disclosed API key. I didn't check on Aviary though since I found out that Aviary is already a defunct image editor. Steps To Reproduce: API Key Disclosure: To reproduce the API Key Disclosure vulnerability, you can perform the following steps: 1. Visit https://hackerone.com/stripo/hacktivity?filter=type%3Apublic&type=team 2. You will see a disclosed report entitled "Public and secret api key leaked in JavaScript source". Visit this report: https://hackerone.com/reports/983331 3. You will see the following two lines in the report: aviaryApiKey: "███████", youtubeApiKey: "██████████", You can see the API keys from Aviary and YouTube are disclosed in this report....
SOCIAL SHARE CARD GENERATOR