# Getting access to Zendesk’s Google Cloud and Artifactory from GitHub dotfile repos

Zendesk employee dotfile repos on GitHub leaked valid Artifactory tokens and GCloud legacy credentials, granting access to ~150 GCP projects and Artifactory.

- Payout: $3,000
- Severity: critical
- Program: Zendesk
- Found by: Ruby Nealon (@_ruby)
- Disclosed: 2019-04-23
- Write-up quality: 6/10
- Original: https://blog.assetnote.io/bug-bounty/2019/04/23/getting-access-zendesk-gcp/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-04-23-getting-access-zendesk-gcp
- Tags: area:cloud domain:cloud domain:oss impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:gcp tech:github-actions technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** Public GitHub dotfile repositories containing CLI/SDK credential files
**Root cause:** Employees committed dotfiles containing Artifactory tokens and GCloud legacy-credentials folders to public GitHub repos, leaving valid credentials in HEAD of master.
**Steps:**
1. Monitor GitHub for public repos containing Zendesk employee dotfiles via TPPE.
2. Extract `ARTIFACTORY_USERNAME` and `ARTIFACTORY_KEY` from repo env vars.
3. Validate with `curl -u $ARTIFACTORY_USERNAME:$ARTIFACTORY_KEY https://<host>/artifactory/api/build` returning a valid build URI.
4. Copy the repo's `.config/gcloud` folder to `~/.config/gcloud` locally.
5. Run `gcloud projects list` to enumerate ~150 accessible projects (Bime prod/preprod/dev, Zendesk Authentication, Voice Production, Zendesk Billing).
6. Second repo: validate `ARTIFACTORY_API_KEY` via `curl -i -u $ARTIFACTORY_USERNAME:$ARTIFACTORY_API_KEY https://<host>/<path>/artifactory/api/`.
**How found:** Assetnote's TPPE monitor scanned public GitHub for credential patterns in employee dotfiles; flagged two repos with Artifactory tokens and a GCloud legacy-credentials folder, then manually validated each.
**Exploitation:** Using leaked credentials directly: Artifactory token authenticated to JFrog API; GCloud legacy credentials folder dropped into local gcloud config allowed CLI access as the user, enumerating ~150 projects and potentially `gcloud compute ssh` into externally reachable instances.
**Escalation:** GCloud access to production projects (Billing, Voice Production, Authentication) could enable SSH into compute instances via `gcloud compute ssh`, though not tested at discovery.
**Insight:** Dotfile repos (`.config/gcloud`, `.bashrc`, `.npmrc`) are high-yield: a GCloud legacy-credentials folder can be dropped straight into `~/.config/gcloud` to impersonate the user via CLI, bypassing the need to craft raw API auth.

## Proof of concept (copied exactly from the original report)

**GCloud legacy credentials used via gcloud CLI**

```
ruby@nippon:~|⇒  cp <REDACTED>/.config/gcoud ~/.config/gcloud
ruby@nippon:~|⇒  gcloud projects list
```

**Second Artifactory API key validation**

```
export ARTIFACTORY_USERNAME="<REDACTED>"
export ARTIFACTORY_API_KEY="<REDACTED>"
curl -i -u $ARTIFACTORY_USERNAME:$ARTIFACTORY_API_KEY https://<REDACTED>/<REDACTED>/artifactory/api/
```