(This image was created with the assistance of DALL·E 2)
The Silent Saboteur: Plain Text Credentials on Webpages
Welcome back to our blog series: Vulnerability of the Month! With this series we would like to give you insights into our and our hackers’ daily work and talk about vulnerabilities. By doing so, we hope to help spread important security knowledge about specific vulnerabilities, how to find them, techniques used and by doing that raise awareness to all the vulnerabilities that may still be out there.
If you want to learn more about the series and why we do it this way, please have a look at the first blog post available here: https://www.bugbounty.ch/votm-jan-23/
Author: this month’s blog post was authored by Cindy Yang
Credits: this month’s vulnerability was reported by pprab
Context of the Bug Bounty program
- A time-limited, budget-limited private program
- In scope is a big part of the exposed websites of the customer with dozens of domains
- Time between launch of the program and submission of the report: ~4 months
Why this vulnerability
It’s like going to the dentist to get your teeth cleaned but forgetting to brush them regularly at home. What could possibly go wrong? Let’s check it out!
The system affected
One of the web-based assets of the customer.
The vulnerability as described by the hacker
The path to the vulnerability
While examining the source code of the webpage, the hacker detected some commented code containing the username and the password of the admin, and they still worked – sometimes it is that simple…
Full admin access to the admin part of the system, since the hacker has access to the username and password of the admin user.
This report is from the category of «no way – this will never happen to us». But our experience shows mistakes happen, and nobody is immune to them.
What went wrong?
The relevant JS snippet has been commented out, so the local, JS-based login functionality wasn’t in use anymore and was probably used during development. The problem was that the credentials haven’t been rotated/changed when switching to the proper authentication mechanism. In addition, try to reduce the attack surface by removing unused code before using it in production and exposing it to the internet.
Interested in finding vulnerabilities? We’re always looking for new hacking talents – please register yourself here: bugbounty.ch/hacker!