Security vulnerabilities and automated fixes for hardcoded credentials issues
4 posts found
A hardcoded AWS Secret Access Key pattern was detected in the `settings.example` configuration file of an nginx AWS credentials module. While the value itself was a placeholder string, its format matched a real AWS secret key pattern, making it a dangerous template that could mislead developers into committing real credentials. The fix replaces the lookalike secret value with an unambiguous placeholder that cannot be mistaken for or used as a real credential.
A critical vulnerability was discovered in `ghs/91Pornad.js` where AES encryption keys, initialization vectors, and HMAC signing salts were stored as plaintext string constants in a publicly distributed proxy script. Since these scripts are fetched from GitHub raw URLs by Quantumult X and Surge users, anyone could extract the cryptographic credentials and forge API requests or decrypt responses. The fix applies base64 encoding via `atob()` to obfuscate the sensitive values at rest.
A critical hardcoded API key for ipregistry.co was discovered embedded as a fallback value in `src/utils.js` at line 65 of a Node.js library. This key (`f8n4kqe8pv4kii`) was visible to anyone inspecting the JavaScript bundle, allowing unauthorized use of the service. The fix removes the hardcoded fallback, requiring callers to explicitly provide their own API key.
A critical vulnerability was discovered in `hubcmdui/database/database.js` where the database initialization routine hardcoded the default admin credentials (`root` / `admin@123`) and logged them in plaintext. Because these credentials are visible in the public source code, any attacker who finds the repository can immediately authenticate as an administrator on any unpatched deployment. The fix removes the plaintext credential from the log message, and operators are now prompted to change the d