tktchurch website 0.1.0 Stripe API hard-coded credentials

Summaryinfo

A vulnerability, which was classified as critical, has been found in tktchurch website 0.1.0. The impacted element is an unknown function of the component Stripe API. The manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2023-36817. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in tktchurch website 0.1.0. This issue affects an unknown functionality of the component Stripe API. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality. The summary by CVE is:

`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase.

The weakness was disclosed 07/04/2023 as GHSA-x3m6-5hmf-5x3w. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-36817 since 06/27/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

Applying a patch is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• tktchurch

Name

• website

Version

• 0.1.0

Website

• Product: https://github.com/tktchurch/website/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion