# Escalating a GitHub leak to takeover entire organization

Deleted Helm YAML in a GitHub repo still held Matrix bot credentials; logging into the self-hosted Matrix server exposed Grafana passwords, logs and private keys.

- Payout: $4,000
- Severity: high
- Program: -
- Found by: Shashank (@cyberboyIndia)
- Disclosed: 2020-08-18
- Write-up quality: 6/10
- Original: https://blog.shashank.co/2020/08/escalating-github-leak-to-takeover.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-shashank-co-2020-08-escalating-github-leak-to-takeover-html
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:github-actions technique:recon technique:source-review vuln:auth-bypass vuln:secrets-leak

**Target:** Self-hosted Matrix/Element homeserver and GitHub repository
**Root cause:** Credentials committed in a Helm values YAML were only deleted from the working tree, not from git history, so the Matrix bot username/password remained recoverable in the repository.
**Steps:**
1. Search GitHub for leaked credentials, focusing on deleted files still present in commit history.
2. Find a YAML with `matrixbot-username` and `matrixbot-password` defaults containing `some_leaked_username`/`some_leaked_password`.
3. Identify Matrix as a chat client; try https://app.element.io/#/login with the creds — fails.
4. Infer the bot uses a self-hosted homeserver; enumerate subdomains and find `matrix.thewebsite.com`.
5. On app.element.io login, add custom server `matrix.thewebsite.com`, enter leaked username/password — login succeeds.
6. Read channel descriptions containing Grafana passwords, server logs and private keys; log out and report.
**How found:** Routine GitHub credential hunting with special attention to deleted files, since deleting a file doesn't remove it from repository history; a Helm values YAML with default bot credentials stood out, and the self-hosted hint in the YAML drove subdomain recon.
**Exploitation:** Attacker recovers bot credentials from git history, identifies the self-hosted Matrix homeserver via subdomain recon, logs in through the Element web client using a custom homeserver, and reads sensitive data (Grafana creds, private keys, logs) exposed in channel descriptions.
**Escalation:** Bot account access to internal chat channels yielded Grafana passwords and private keys, enabling potential pivot to further internal systems and org-wide takeover.
**Insight:** Helm values files often carry `default "..."` fallback credentials that are real; when public SaaS login fails, pivot to the self-hosted equivalent (e.g. custom homeserver on app.element.io) found via subdomain enumeration.

## Proof of concept (copied exactly from the original report)

**Leaked Matrix bot credentials in YAML**

```
data:
 matrixbot-username: {{ .Values.matrixbot.username | default "some_leaked_username" | b64enc }}
 matrixbot-password: {{ .Values.matrixbot.password | default "some_leaked_password" | b64enc }}
```