# JumpCloud API Key leaked via Open Github Repository.

A Starbucks JumpCloud API key committed to a public GitHub repo allowed listing systems, users and SSO apps, enabling command execution and AWS takeover.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: vinothkumar
- Disclosed: 2019-12-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/716292
- Library page: https://bugbountylibrary.com/r/h1%3A716292
- Tags: area:cloud domain:cloud impact:internal-access impact:privesc impact:rce kind:bounty platform:hackerone sev:critical tech:github-actions technique:recon vuln:auth-bypass vuln:secrets-leak

**Target:** JumpCloud admin API (console.jumpcloud.com) and a public GitHub repository
**Root cause:** A JumpCloud API key was hard-coded in a Go source file (getSystemUsers.go) committed to a public GitHub repository, exposing a privileged API credential.
**Steps:**
1. Search GitHub for Starbucks-related code and find public repo with getSystemUsers.go containing `req.Header.Add("x-api-key", "████████")`
2. List systems: `curl -H "x-api-key: ████████" "https://console.jumpcloud.com/api/systems"` — multiple AWS instances returned
3. List users: `curl -H "x-api-key: █████" "https://console.jumpcloud.com/api/systemusers"`
4. List SSO apps: `curl -H "x-api-key: ██████" "https://console.jumpcloud.com/api/applications"` — AWS login SAM config present
**How found:** Reporter searched GitHub for Starbucks-related code and found a public repository whose Go source hard-coded the JumpCloud API key in an x-api-key header.
**Exploitation:** Using the leaked key against the JumpCloud API, the reporter enumerated systems, system users and SSO applications. The applications endpoint exposed an AWS login SAM configuration, which the reporter assessed would lead to AWS account takeover; JumpCloud's command API would also allow remote command execution on managed systems.
**Escalation:** Pivot from JumpCloud directory API access to AWS via the exposed SAM/SSO application config, and to host compromise via JumpCloud command execution.
**Insight:** Org-wide SaaS admin keys (JumpCloud, Okta, MDM) often leak in internal tooling repos that call the vendor API directly; GitHub code search for the vendor's auth header name plus the target brand surfaces them, and the SSO/applications endpoint often yields downstream cloud credentials.

## Proof of concept (copied exactly from the original report)

**curl listing JumpCloud systems with leaked key**

````
curl -H "x-api-key: ████████" "https://console.jumpcloud.com/api/systems"
``` There are multiple AWS instances present
````

**curl listing JumpCloud system users**

```
curl -H "x-api-key: █████" "https://console.jumpcloud.com/api/systemusers"
```

**curl listing SSO applications for AWS takeover**

````
curl -H "x-api-key: ██████" "https://console.jumpcloud.com/api/applications"
``` AWS login SAM config is presents. This would leads to AWS account takeover
````