# Exposed service with weak default credentials

Internet-reachable DB, registry or dev service reachable with default or guessable admin credentials

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $5,000; latest 2024-07-25. Updated 2026-10-23._

## How it works
A service that is meant to sit behind a network boundary or an authentication layer is reachable from the internet, and its access control is either absent by default or trivially guessable. The assumption that breaks is "this service is internal" or "only trusted operators reach it." Once an attacker authenticates (or needs no auth at all), the service's own admin features become the attack surface: query execution, binary-path settings, scripting engines, or command shells.

## Where it shows up
- Dev/staging subdomains resolving publicly, especially ones leaked by referrer or whitelist regexes in client JS [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md)
- Security-group or firewall rules that expose a host directly instead of via the intended authenticated endpoint [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md)
- Services shipping with no auth by default (Selenium Grid hub on 4444) [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps.md)
- Database admin accounts with weak/guessable passwords (MSSQL `sa`) reachable on 1433 [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c.md)
- Outdated components with dangerous features enabled (Elasticsearch dynamic scripting) [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md)
- Admin features that grant OS-level execution: `xp_cmdshell`, Chrome binary path / interpreter args [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c.md)

## How to review
Check the invariant: every internet-reachable service must require strong authentication before any privileged capability is usable, and privileged capabilities (command execution, binary path, scripting) must not be settable by an unauthenticated or default-credential caller. Concretely: enumerate exposed hosts and ports; confirm auth is on and not default; confirm dangerous features are disabled; confirm network policy matches intent (dev hosts not public).

## Variants seen
- Exposed dev environment leaking credentials and keys, pivoting to production DB [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md)
- Unauthenticated test-automation service turned into RCE via binary-path option [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps.md)
- Weak DB admin password brute-forced, then `xp_cmdshell` re-enabled for OS execution [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c.md)

## Impact and severity
High to critical: full production database access and cloud/email key theft [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md); arbitrary command execution and cryptominer deployment across ~30k exposed hubs [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps.md); host compromise with AV disabled and persistence [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c.md). Severity rises when the service grants OS execution and when one foothold yields credentials to other systems.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-imgur-for-fun-and-profit-3b2ec30c9463.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c.md