{"id":113367,"date":"2024-02-02T19:41:12","date_gmt":"2024-02-02T17:41:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes"},"modified":"2024-02-02T19:41:12","modified_gmt":"2024-02-02T17:41:13","slug":"v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","title":{"rendered":"Un jeton GitHub des d\u00e9p\u00f4ts internes de Mercedes a \u00e9t\u00e9 trouv\u00e9 dans le code public","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Lors d'une analyse des fuites de donn\u00e9es confidentielles dans les d\u00e9p\u00f4ts GitHub men\u00e9e par la soci\u00e9t\u00e9 RedHunt Labs, une publication dans un d\u00e9p\u00f4t public d'un token API a \u00e9t\u00e9 identifi\u00e9e, permettant d'acc\u00e9der sans restriction aux d\u00e9p\u00f4ts internes de la soci\u00e9t\u00e9 Mercedes-Benz, h\u00e9berg\u00e9s sur un serveur interne bas\u00e9 sur la plateforme Github Enterprise Server. Il est suppos\u00e9 que le token a \u00e9t\u00e9 accidentellement publi\u00e9 par l'un des employ\u00e9s de Mercedes-Benz parmi le code h\u00e9berg\u00e9 dans le d\u00e9p\u00f4t public sur GitHub. <\/p>\n

Le token est pr\u00e9sent dans le d\u00e9p\u00f4t depuis le 29 septembre 2023 et a \u00e9t\u00e9 identifi\u00e9 le 11 janvier 2024. Apr\u00e8s avoir inform\u00e9 la soci\u00e9t\u00e9 de l'incident le 24 janvier, le token a \u00e9t\u00e9 r\u00e9voqu\u00e9. Selon les d\u00e9clarations des repr\u00e9sentants de Mercedes-Benz, le token divulgu\u00e9 permettait d'acc\u00e9der non pas \u00e0 l'int\u00e9gralit\u00e9 du code source h\u00e9berg\u00e9, le serveur<\/a>, mais uniquement \u00e0 certains d\u00e9p\u00f4ts internes de la soci\u00e9t\u00e9. Dans le m\u00eame temps, le rapport des chercheurs ayant identifi\u00e9 le token indique que dans les d\u00e9p\u00f4ts internes auxquels il \u00e9tait possible de se connecter via le token trouv\u00e9, il y avait des documents techniques confidentiels et des informations repr\u00e9sentant un secret commercial, ainsi que des donn\u00e9es sensibles telles que des identifiants de connexion \u00e0 des syst\u00e8mes de gestion de bases de donn\u00e9es, des cl\u00e9s d'acc\u00e8s \u00e0 des services cloud, des cl\u00e9s d'acc\u00e8s \u00e0 l'API et des mots de passe pour acc\u00e9der aux services. <\/p>\n

Il convient \u00e9galement de noter que la soci\u00e9t\u00e9 Escape a r\u00e9alis\u00e9 un scan d'un million domaines<\/a> pour d\u00e9tecter la pr\u00e9sence de cl\u00e9s et de tokens d'API en acc\u00e8s public. Lors de cette analyse, au cours de laquelle 189,5 millions d'URL ont \u00e9t\u00e9 examin\u00e9, 18 458 cl\u00e9s et tokens int\u00e9gr\u00e9s aux pages ont \u00e9t\u00e9 trouv\u00e9s, dont 41% sont critiques, c'est-\u00e0-dire que leur perte entra\u00eene des risques financiers importants. Par exemple, selon les chercheurs, le montant des fonds accessibles via les tokens laiss\u00e9s sur les pages pour acc\u00e9der \u00e0 l'API Stripe est d'environ 20 millions de dollars. <\/p>\n

Parmi les donn\u00e9es sensibles d\u00e9voil\u00e9es sur les pages, on retrouve des tokens d'acc\u00e8s \u00e0 GitHub (51,5%), GitLab, Stripe (0,9%), OpenAI (1,4%), AWS, Twitch (0,7%), Coinbase, X\/Twitter (2,7%), Slack (9,5%) et Discord (1,2%), ainsi que des cl\u00e9s RSA priv\u00e9es (26,3%). 35% des cl\u00e9s et tokens identifi\u00e9s se trouvaient dans des fichiers JavaScript. Dans 2,1% des cas, des donn\u00e9es sensibles ont \u00e9t\u00e9 trouv\u00e9es dans des fichiers r\u00e9sultant de la compilation de code JavaScript en un seul fichier.

\"Un<\/center>
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 RedHunt Labs \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 API-\u0442\u043e\u043a\u0435\u043d\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Mercedes-Benz, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Github Enterprise Server. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0442\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 Mercedes-Benz \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0434\u0430, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":113368,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Un jeton GitHub des d\u00e9p\u00f4ts internes de Mercedes trouv\u00e9 dans le code public | ProHoster","description":"Lors d'une analyse des fuites de donn\u00e9es confidentielles sur les d\u00e9p\u00f4ts GitHub r\u00e9alis\u00e9e par RedHunt Labs, une publication contenait un jeton API dans un d\u00e9p\u00f4t public, permettant d'acc\u00e9der sans restriction.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0439\u0434\u0435\u043d GitHub-\u0442\u043e\u043a\u0435\u043d \u043e\u0442 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u041c\u0435\u0440\u0441\u0435\u0434\u0435\u0441 | ProHoster","og:description":"\u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 RedHunt Labs \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 API-\u0442\u043e\u043a\u0435\u043d\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T17:41:13+00:00","article:modified_time":"2024-02-02T17:41:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113367","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:38:00","updated":"2026-02-11 11:12:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=113367"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113367\/revisions"}],"predecessor-version":[{"id":160547,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113367\/revisions\/160547"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/113368"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=113367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=113367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=113367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}