地图 / [com.smule.autorap.*] Cloud Messaging/Push Notification service takeover due to clear-text usage of Legacy FCM Server keys in the client app

[com.smule.autorap.*] Cloud Messaging/Push Notification service takeover due to clear-text usage of Legacy FCM Server keys in the client app

信息泄露 / 硬编码凭据 / #789370

厂商: Smule
严重程度: 高危
赏金: —
弱点: 硬编码凭据
研究员: @absshax
披露日期: 2020-08-24
资产: com.smule.autorap.*
CVE: —

该报告还没有中文解读。

时间线

2020-02-05报告提交
2020-08-24公开披露

阅读 HackerOne 原文 ↗作者 @absshax · 版权归作者与 Smule 所有

同类报告

JumpCloud API Key leaked via Open Github Repository.Starbucks · 2019-12-30 Important information leaked on GithubEquifax-vdp · 2019-08-22 Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM)8x8 · 2023-04-27 [█████████] Hardcoded credentials in Android AppEternal · 2017-07-19 · $500 Credentials leaked via GithubAcronis · 2024-08-26 · $50 Exposed valid AWS, Mysql, Sendgrid and other secretsGlovo · 2022-07-08

[com.smule.autorap.*] Cloud Messaging/Push Notification service takeover due to clear-text usage of Legacy FCM Server keys in the client app · 破甲 POJIA