Direct access to admin dashboard via leaked credentials

5 months ago 32
BOOK THIS SPACE FOR AD
ARTICLE AD

Saeid Khater

Overview of the Vulnerability:

This security vulnerability occurs when unauthorized individuals gain direct access to an admin dashboard by exploiting leaked or exposed credentials. Such credentials could be compromised through various means, including data breaches, phishing attacks, or inadequate password management practices. This bug is critical as it provides attackers with administrative privileges, allowing them to manipulate sensitive data, alter system settings, and potentially compromise the entire application or system.

Steps:

While I was inspecting the normal flow of the application, and reading every source code of every page that came across, I found something interesting in the JavaScript code on the same page.

APPD_SERVICE_USER":"[Redacted]@msrv.appdynamics.com","APPD_SERVICE_PWD":"[Redacted]""
"CCI_IDP_ID":"[Redacted]","APPD_DOCEBO_USERNAME":"[Redacted]-admin@appdynamics.com","APPD_DOCEBO_PASSWORD":"[Redacted]","LAUNCH_DARKLY_CLIENT_ID":"[Redacted]","SMARTLOOK_CLIENT_ID":"[Redacted]"

Just log in and go to the admin Dashboard :)

Read Entire Article