Fluid Attacks Database

Description

The source code repository contains sensitive information: JFrog Access Token

Weakness:

009 - Sensitive information in source code

Category: Information Collection

Detection Strategy

• Matches JFrog Access Token patterns in source code and configuration files

Vulnerable code example

export JFROG_ACCESS_TOKEN=cmVmdGtuOjAxOjE4MjIyODMwNTQ6WFJlTDNFQ3k3aFpub1NDdEJQZEtJTW1VamdF
JF_ACCESS_TOKEN="cmVmdGtuOjAxOjAwMDAwMDAwMDA6TXdXcWpUSko3V2wyck9QejRBaDRHV1hPeVU1"
curl -H "Authorization: Bearer cmVmdGtuOjAxOjE4MjA4MTAwODQ6WFBPMzdWUnRmWjZrYlBiRUhPa3VCc1h4UlVy" https://acme.jfrog.io/xray/api/v1/summary/artifact
      ARTIFACTORY_ACCESS_TOKEN: eyJ2ZXIiOiIyIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYiLCJraWQiOiI2dXdoTExxUEQyUUFPbkh4b1Exa0JTS2drdFBRc093Z1BNdWpEUUxGVVhnIn0.eyJzdWIiOiJqZmFjQDAxYTV0aTl5bTd0YmI1Z3BydmpzM3dob3BoL3VzZXJzL2NpIiwic2NwIjoiYXBwbGllZC1wZXJtaXNzaW9ucy91c2VyIiwiYXVkIjoiKkAqIiwiaXNzIjoiamZhY0AwMWE1dGk5eW03dGJiNWdwcnZqczN3aG9waCIsImlhdCI6MTc5MTk5NTg2MCwianRpIjoiY2IxMTk5NjYtNjFlOS00MjZhLWIxYmUtN2RlN2I1NzJiNjBkIn0.ihl39SbMhyvWIR329SmcEZ-rKNV07sO_k0M--_IdnnVGCRwTrC411vZpT9zWjS3tu0ZpRVRg1jtoblxBvdnQIEgnpyvQ2JHtq8TetqcYYd8xL7TvW6ZB9NZBIFOLbvipC-SVeZ1IoXHQJU86CQgi1b_C5uotWY7XKw238T3D4G5NA-ezonohUhdhWkboYYJhA7csJRhk_JWy1kVoWSSMWzsz9nIbJm66y3ks7yzlx6gsAvyfnzFSJ6nGkvvZeGcwQwN-chDrZiorCwgBOCNUtxPezjyKEtSAXf-HBFIy3xvyqO40elUntF_nfv4KEG012UakH5Tes5hCMol_ZFx3l_
jf c add acme --url=https://acme.jfrog.io --access-token=eyJ2ZXIiOiIyIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYiLCJraWQiOiJxVXV0Tmdma1ZnUy1FY0VfX3JFUnNoeGt5WXQwRHg3cjVNcmZEZmdtTWhMIn0.eyJzdWIiOiJqZmFjQDAxeGN6ZXVsb3Y3YmU1YWFueHVlbmZ3bmN2L3VzZXJzL2NpIiwic2NwIjoiYXBwbGllZC1wZXJtaXNzaW9ucy91c2VyIiwiYXVkIjoiKkAqIiwiaXNzIjoiamZhY0AwMXhjemV1bG92N2JlNWFhbnh1ZW5md25jdiIsImlhdCI6MTc5MzIyMDI5MiwianRpIjoiNzRjNTJhM2EtNjFlOS00MjZhLWIxYmUtYzYwZWFlMWQwZmUxIn0.L7M6fhNgjUmPCYocEL7-9B0qkAwfmUjcYnE_4kJYa77zc0S0PNs4yiyByXEIUAS_ShI25bfSBcoFQWsWNuNMzTRVOSLFrGze2v_P1JCDB6Hfz_NoJJqwnf89FpD7L4VjVbZImgUIvBGL9BLj3vrbJ6loJR9gAyWVf3EOAEQM_FkxWcXn8487t-3xeTIIAotMtqLJEAFVninMswF8yVlbhXUwQ2_zLgxWKco6BQMcxDrqecXfwIe_xB8L_HTul9IGaSsHNUgeyZjnkk7cjnVWDpFOkHh5Ok1inbzWpTija4Mpgxm8BcH5rM0IbYD3Lk4_VgruhY0i2s6GWY7U3N7qLTTKyGpRW-H6yibd9jlYoICyjUNVw595OI20b9PfT090iRyQ7Ycr9jJy_02IwV7tXI9JhwyXBA3wWsVA1cKL847dLkGAWuwJk_djmJaIeoaM6hfQkyfmugP4ohD6Ltow2lox-9EWXo8z7nsDoXZmD_EgvAdL_4YXmRBJuMV6w_S7TM5jc54AndXxiSCVKPbF2EX6paaRiSAi86GPKgrIuOvyaSC6jALA3j3RAyjDVfApJDgUuafGTeWK_2nL2snMCWJCvrGC0EBar7toTpJ_wEdrEPlKF_Yp7BOjc-gr92YG-nXDLzslBhURB_jTlCAJc72gp3IKiWBjgln-i1hW3SN
curl -u ci:cmVmdGtuOjAxOjE4MjM5NTcxMzk6YnNWTzA4aERTYWpzWVM3MWpqWDlTYXU3bEhF https://acme.jfrog.io/artifactory/api/repositories
xray_token = 'eyJ2ZXIiOiIyIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYiLCJraWQiOiJrWXVDNk13aHFQTmNjbGl2a1gtb1NadmdqV01EcmtqQm95aFQxX0l1VWt1In0.eyJzdWIiOiJqZmFjQDAxbGQ4ZG41ZGdkbmNhbHdtZ25ydTR3ZHk5L3VzZXJzL2NpIiwic2NwIjoiYXBwbGllZC1wZXJtaXNzaW9ucy91c2VyIiwiYXVkIjoiKkAqIiwiaXNzIjoiamZhY0AwMWxkOGRuNWRnZG5jYWx3bWducnU0d2R5OSIsImlhdCI6MTc5NDExNTE2NSwianRpIjoiZmIyZGFkMzktNjFlOS00MjZhLWIxYmUtMjBmMmYwMDY0NzNhIn0.qSUHxqJUvMlj7JttRV8jExiIldHlqKRgmoTnXkCIbzte-tvhFj1tHztaJ_epQqMUT9BcrBkFeDzhkX2AprwBpaq-mYMY-T_6vgirFhpEA1iokEJKwi1c1ALRY3S8YICYhFrKrH0nyyA3w-vm733l_4sLJqXNmQvrtyjbrtG8-k52kVh7Ktx48Iey9X8fny94OqwJQom1BXGc1ScOKq2BCHPer0cH6O-kYDge1mVM7Tc45BxrfDJjx7_LoprIJaFfxfHX-HRBbnPFp9EWUn67r3WNuXA-xvY3urVYZraoxUnnO5_ffSHXPsg3aXLW7EabAnD0D7dgxGUGvvUrhnDiyW'
//acme.jfrog.io/artifactory/api/npm/npm/:_authToken=cmVmdGtuOjAxOjE4MDYxNzQyNzk6UzJ0cm5YVWVmbUJoQW1rWkdyS3NzQVhtREV2

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.