Secret · Code · first seen 9 Oct
CriticalConfirmed exploitableOpenChidi Ezefix by 16 Oct, 2 days late
payments-api · src/config/aws.ts:14 · we asked the provider
Deactivate the key in AWS IAM now, then create a new one and keep it in your secrets manager. Blocking the merge kept it out of main, but the commit is on GitHub, so deleting the line doesn't take it back.
One problem in one place, found by code. Proven in one.
1 source · 1 place
Code
secrets/aws-access-key · commit a41c9e2 by Chidi
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
1st of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
96 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The code · tessellate/payments-api · chidi/settlement-backfill branch
Open the repositorysrc/config/aws.ts · on chidi/settlement-backfill
| 11 | export const s3 = new S3Client({ |
| 12 | region: "eu-west-2", |
| 13 | credentials: { |
| 14 | accessKeyId: "AKIA••••••••••••••••", |
| 15 | secretAccessKey: "wJal••••••••••••••••", |
| 16 | }, |
| 17 | }); |
Confirmed live
We asked AWS who the key belongs to, a read-only call that changes nothing, and it answered. Anyone who copied it from GitHub can use it now.
The fix
Deactivate the key in AWS IAM now, then create a new one and keep it in your secrets manager. Blocking the merge kept it out of main, but the commit is on GitHub, so deleting the line doesn't take it back.
What happened, and what was said
4 events · 1 comment · oldest first