Code Beautifiers Expose Credentials From Banks, Govt, Tech Orgs

Thousands of credentials, authentication keys, and configuration data impacting organizations in sensitive sectors have been sitting in publicly accessible JSON snippets submitted to the JSONFormatter and CodeBeautify online tools that format and structure code.

Researchers discovered more than 80,000 user pastes totaling over 5GB exposed through a feature called Recent Links provided by both services, which is freely accessible to anyone.

Some of the companies and organizations with sensitive data leaked this way are in high-risk sectors like government, critical infrastructure, banking, insurance, aerospace, healthcare, education, cybersecurity, and telecommunications.

Researchers at external attack surface management company WatchTowr examined the JSONFormatter and CodeBeautify online platforms and found that their Recent Links feature provided access to JSON snippets that users had saved on the services' servers for temporary sharing purposes.

When clicking the 'save' button, the platform generates a unique URL pointing to that page and adds it to the user’s Recent Links page, which has no protection layer, thus leaving the content accessible to anyone.

Since Recent Links pages follow a structured, predictable URL format, the URL can be easily retrieved with a simple crawler.

By scraping these public “Recent Links” pages and pulling the raw data using the platforms’ getDataFromID API endpoints, watchTowr collected over 80,000 user pastes corresponding to five years of JSONFormatter data and one year of CodeBeautify data with sensitive details:

In one case, the researchers found "materially sensitive information" from a cybersecurity company that could be easily identified. The content included "encrypted credentials for a very sensitive configuration file," SSL certificate private key passwords, external and internal hostnames and IP addresses, and paths to keys, certificates, and configuration files.

Pastes from a government entity included 1,000 lines of PowerShell code that configured a new host by fetching installers, "configuring registry keys, hardening configurations, and finally deploying a web app."

Even if the script did not include sensitive data, watchTowr says that it had valuable information that an attacker could use, such as details about internal endpoints, IIS configuration values and properties, and hardening configurations with the corresponding registry keys.

Source: BleepingComputer