Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

Mercedes Source Code Exposed by Leaked GitHub Token

A leaked token provided unrestricted access to the entire source code on Mercedes-Benz’s GitHub Enterprise server.

Mercedes Source Code Exposed

A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server, attack surface firm RedHunt Labs reports.

The token, which was discovered during an internet scan, was leaked in the employee’s GitHub repository, and provided unrestricted and unmonitored access to the source code.

The breach, RedHunt says, occurred on September 29, 2023, but was not discovered until January 11, 2024. Mercedes revoked the leaked token on January 24, two days after being alerted of the incident.

“Mercedes-Benz confirmed the leak, acknowledging the severity of the situation, and took immediate action by revoking the relevant API token,” RedHunt notes.

During the exposure period, an attacker could have used the token to access API keys, blueprints, cloud access keys, database connection strings, design documents, files, reports, source code, SSO passwords, and other critical internal information, RedHunt says.

Impact from the data breach, the cybersecurity firm says, could have gone beyond this extensive intellectual property exposure, as it could have had significant financial implications, could have led to legal violations, and potential reputational damage.

“The leaked GitHub Token for Mercedes’s Github Enterprise Server opens a gateway for potential adversaries to access and download the entire source code of the organization. Delving into this source code could expose highly sensitive credentials, creating a breeding ground for an extremely serious data breach against Mercedes,” RedHunt points out.

In October 2023, cybersecurity firm Palo Alto Networks warned that threat actors were observed harvesting IAM credentials leaked in public GitHub repositories within minutes after exposure.

Advertisement. Scroll to continue reading.

Earlier this month, GitHub rotated credentials after learning that a vulnerability in GitHub.com and GitHub Enterprise Server could have allowed access to credentials within a production container.

Related: CISA Urges Patching of Exploited SharePoint Server Vulnerability

Related: New Class of CI/CD Attacks Could Have Led to PyTorch Supply Chain Compromise

Related: Major Organizations Using ‘Hugging Face’ AI Tools Put at Risk by Leaked API Tokens

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn about active threats targeting common cloud deployments and what security teams can do to mitigate them.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

Sony shares information on the impact of two recent unrelated hacker attacks carried out by known ransomware groups. 

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.

Data Breaches

AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.