Improper Access Control in codingtrain/website


Reported on

May 21st 2021

✍️ Description

Google Maps API key without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account.

🕵️‍♂️ Proof of Concept

Visit this link to verify that you can use the service by visiting the following link:

However with the proper restrictions, it should return a Forbidden error. Unrestricted Services: Custom Search: $5 per 1000 requests

💥 Impact

Attacker is able to abuse your API key. If billing is enabled in your profile, attackers can use your key while your account gets charged.

3 years ago

Thank you @hakk3r

to join this conversation