A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server, attack surface firm RedHunt Labs reports.
The token, which was discovered during an internet scan, was leaked in the employee’s GitHub repository, and provided unrestricted and unmonitored access to the source code.
The breach, RedHunt says, occurred on September 29, 2023, but was not discovered until January 11, 2024. Mercedes revoked the leaked token on January 24, two days after being alerted of the incident.
“Mercedes-Benz confirmed the leak, acknowledging the severity of the situation, and took immediate action by revoking the relevant API token,” RedHunt notes.
During the exposure period, an attacker could have used the token to access API keys, blueprints, cloud access keys, database connection strings, design documents, files, reports, source code, SSO passwords, and other critical internal information, RedHunt says.
Impact from the data breach, the cybersecurity firm says, could have gone beyond this extensive intellectual property exposure, as it could have had significant financial implications, could have led to legal violations, and potential reputational damage.
“The leaked GitHub Token for Mercedes’s Github Enterprise Server opens a gateway for potential adversaries to access and download the entire source code of the organization. Delving into this source code could expose highly sensitive credentials, creating a breeding ground for an extremely serious data breach against Mercedes,” RedHunt points out.
In October 2023, cybersecurity firm Palo Alto Networks warned that threat actors were observed harvesting IAM credentials leaked in public GitHub repositories within minutes after exposure.
Earlier this month, GitHub rotated credentials after learning that a vulnerability in GitHub.com and GitHub Enterprise Server could have allowed access to credentials within a production container.
Related: CISA Urges Patching of Exploited SharePoint Server Vulnerability
Related: New Class of CI/CD Attacks Could Have Led to PyTorch Supply Chain Compromise
Related: Major Organizations Using ‘Hugging Face’ AI Tools Put at Risk by Leaked API Tokens
