{"id":113367,"date":"2024-02-02T19:41:12","date_gmt":"2024-02-02T17:41:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes"},"modified":"2024-02-02T19:41:12","modified_gmt":"2024-02-02T17:41:13","slug":"v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","title":{"rendered":"W publicznym kodzie znaleziono token GitHub do wewn\u0119trznych repozytori\u00f3w Mercedesa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Podczas skanowania wyciek\u00f3w poufnych danych przez firm\u0119 RedHunt Labs w repozytoriach GitHub zidentyfikowano publikacj\u0119 w publicznym repozytorium tokena API, kt\u00f3ry umo\u017cliwia\u0142 nieograniczony dost\u0119p do wewn\u0119trznych repozytori\u00f3w firmy Mercedes-Benz znajduj\u0105cych si\u0119 na wewn\u0119trznym serwerze w oparciu o platform\u0119 Github Enterprise Server. Zak\u0142ada si\u0119, \u017ce token zosta\u0142 przypadkowo opublikowany przez jednego z pracownik\u00f3w Mercedes-Benz w kodzie zamieszczonym w publicznym repozytorium na GitHubie. <\/p>\n

Token znajduje si\u0119 w repozytorium od 29 wrze\u015bnia 2023 roku i zosta\u0142 wykryty 11 stycznia 2024 roku. Po poinformowaniu firmy o incydencie 24 stycznia token zosta\u0142 uniewa\u017cniony. Zgodnie z o\u015bwiadczeniem przedstawicieli Mercedes-Benz, przy pomocy ujawnionego tokena mo\u017cna by\u0142o uzyska\u0107 dost\u0119p nie do ca\u0142ego kodu \u017ar\u00f3d\u0142owego, umieszczonego na serwerze<\/a>, lecz jedynie do wybranych wewn\u0119trznych repozytori\u00f3w firmy. Przy tym w komunikacie badaczy, kt\u00f3rzy wykryli token, zaznaczone jest, \u017ce w wewn\u0119trznych repozytoriach, do kt\u00f3rych mo\u017cna by\u0142o uzyska\u0107 dost\u0119p za pomoc\u0105 znalezionego tokena, znajduje si\u0119 zamkni\u0119ta dokumentacja techniczna oraz informacje stanowi\u0105ce tajemnic\u0119 handlow\u0105, a tak\u017ce poufne dane, takie jak dane logowania do bazy danych, klucze dost\u0119pu do us\u0142ug chmurowych, klucze dost\u0119pu do API i has\u0142a do us\u0142ug. <\/p>\n

Dodatkowo mo\u017cna wspomnie\u0107 o skanowaniu przeprowadzonym przez firm\u0119 Escape, kt\u00f3re obejmowa\u0142o milion domen\u00f3w<\/a> w poszukiwaniu kluczy i token\u00f3w API dost\u0119pnych w Internecie. Podczas skanowania, w trakcie kt\u00f3rego przeanalizowano 189.5 mln URL, zidentyfikowano 18458 wbudowanych w strony kluczy i token\u00f3w, z kt\u00f3rych 41% jest krytycznie wa\u017cnych, tzn. ich utrata prowadzi do znacznych ryzyk finansowych. Na przyk\u0142ad, wed\u0142ug szacunk\u00f3w badaczy, kwota \u015brodk\u00f3w, do kt\u00f3rych mo\u017cna uzyska\u0107 dost\u0119p dzi\u0119ki pozostawionym na stronach tokenom do API Stripe, wynosi oko\u0142o 20 mln dolar\u00f3w. <\/p>\n

W\u015br\u00f3d zidentyfikowanych na stronach poufnych danych wymieniono tokeny dost\u0119pu do GitHub (51.5%), GitLab, Stripe (0.9%), OpenAI (1.4%), AWS, Twitch (0.7%), Coinbase, X\/Twitter (2.7%), Slack (9.5%) oraz Discord (1.2%), a tak\u017ce prywatne klucze RSA (26.3%). 35% z zidentyfikowanych kluczy i token\u00f3w wyst\u0119powa\u0142o w plikach JavaScript. W 2.1% przypadk\u00f3w poufne dane znaleziono w plikach uzyskanych w wyniku kompilacji kodu JavaScript w jeden plik.

\"W<\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 RedHunt Labs \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 API-\u0442\u043e\u043a\u0435\u043d\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Mercedes-Benz, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Github Enterprise Server. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0442\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 Mercedes-Benz \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0434\u0430, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":113368,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47W publicznym kodzie znaleziono token GitHub z wewn\u0119trznych repozytori\u00f3w Mercedesa | ProHoster","description":"W wyniku skanowania wyciek\u00f3w poufnych danych w repozytoriach GitHub przeprowadzonego przez firm\u0119 RedHunt Labs, odkryto publikacj\u0119 w publicznym repozytorium tokenu API, kt\u00f3ry umo\u017cliwia uzyskanie nieograniczonego dost\u0119pu.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0439\u0434\u0435\u043d GitHub-\u0442\u043e\u043a\u0435\u043d \u043e\u0442 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u041c\u0435\u0440\u0441\u0435\u0434\u0435\u0441 | ProHoster","og:description":"\u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 RedHunt Labs \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 API-\u0442\u043e\u043a\u0435\u043d\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-publichnom-kode-najden-github-token-ot-vnutrennih-repozitoriev-mersedes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T17:41:13+00:00","article:modified_time":"2024-02-02T17:41:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113367","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:38:00","updated":"2026-02-11 11:12:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=113367"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113367\/revisions"}],"predecessor-version":[{"id":160547,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113367\/revisions\/160547"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/113368"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=113367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=113367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=113367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}