"Leaked GitHub Token Exposed Mercedes Source Code"

According to security researchers at RedHunt, a GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server.  The token, discovered during an internet scan, was leaked in the employee’s GitHub repository, providing unrestricted and unmonitored access to the source code.  The researchers stated that the breach occurred on September 29, 2023, but was not discovered until January 11, 2024.  Mercedes revoked the leaked token on January 24, two days after being alerted of the incident.  Mercedes-Benz confirmed the leak, acknowledging the severity of the situation, and took immediate action by revoking the relevant API token.  The researchers stated that during the exposure period, an attacker could have used the token to access API keys, blueprints, cloud access keys, database connection strings, design documents, files, reports, source code, SSO passwords, and other critical internal information.  The researchers noted that the impact of the data breach could have gone beyond this extensive intellectual property exposure, as it could have had significant financial implications, led to legal violations, and potential reputational damage.

SecurityWeek reports: "Leaked GitHub Token Exposed Mercedes Source Code"