2023-08-29 15:36:40 +02:00
|
|
|
include::../../../shared_content/secrets/description.adoc[]
|
|
|
|
|
|
|
|
|
|
== Why is this an issue?
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/rationale.adoc[]
|
|
|
|
|
|
|
|
|
|
=== What is the potential impact?
|
|
|
|
|
|
|
|
|
|
A FCM API key leak is particularly severe if the affected key has
|
|
|
|
|
administrative privileges: The range of topics to which an attacker can
|
|
|
|
|
subscribe and send messages is much larger than with normal privileges.
|
|
|
|
|
|
|
|
|
|
Below are some real-world scenarios that illustrate some impacts of an attacker
|
|
|
|
|
exploiting the secret.
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/impact/phishing.adoc[]
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/impact/malware_distribution.adoc[]
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/impact/codeless_vulnerability_chaining.adoc[]
|
|
|
|
|
|
|
|
|
|
== How to fix it
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/fix/revoke.adoc[]
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/fix/vault.adoc[]
|
|
|
|
|
|
|
|
|
|
=== Code examples
|
|
|
|
|
|
2023-09-22 17:00:16 +02:00
|
|
|
:example_secret: cfUDlZL9YBQ:APA91bJxU9oMf3RbiyqnmUO60KU_JLawjf2yrTfSs3_ZAp3dxZS0J88G5P5AoKWoviAdUK5i-2SB7iHcb4Wd38EMsZXBAAb6GZMaSOeKfaI0DuLxAFTOgGNKRSmj2R9gIQyzpjoThmqe
|
2023-08-29 15:36:40 +02:00
|
|
|
:example_name: fcm_key
|
|
|
|
|
:example_env: FCM_KEY
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/examples.adoc[]
|
|
|
|
|
|
|
|
|
|
//=== How does this work?
|
|
|
|
|
|
|
|
|
|
//=== Pitfalls
|
|
|
|
|
|
|
|
|
|
//=== Going the extra mile
|
|
|
|
|
|
|
|
|
|
== Resources
|
|
|
|
|
|
|
|
|
|
include::../../../shared_content/secrets/resources/standards.adoc[]
|
|
|
|
|
|
|
|
|
|
//=== Benchmarks
|
