3 ms·

This is now down (temporarily) to patch an exploit that was responsibly disclosed. More to follow. I'm sorry for this!

• slowenough 7y ago
  Hey, so it was an interesting couple of hours. I got a responsible disclosure from a security researcher that metadata about the application, including an access_token could be accessed from the browser. This was because the machines were misconfigured (my responsibility) to be authorized to access different cloud services, as is the default. This access token authorizes various operations on the cloud infrastructure provisioned by my account. It could have been disastrous, because an attacker would have been able to use the token to spin up many instances and potentially even gain shell access. According to the activity audit, the token was never used. And there is no indication of anyone using this to attempt to gain unauthorized access to any data in the service. In response to the report I suspended the service immediately, altered the default configurations for this project to prevent such authorization tokens being issued. And I deleted the token that was possibly exposed. The service is now back up. Also, as the researcher pointed out, the same misconfiguration was identified as affecting Shopify[0], 18 months ago, tho the effects and exploit path were different. [0]: https://hackerone.com/reports/341876 https://hackerone.com/reports/341876