Summary
SOCFortress CoPilot may expose cloud-security reports and temporary Google service-account credentials through an unauthenticated static-file directory. An anonymous party that can reach the application and predict or obtain report paths could read sensitive cloud inventories, findings, IAM details, and a private key while a GCP scan is running.
SOCFortress CoPilot may expose cloud-security reports and temporary Google service-account credentials through an unauthenticated static-file directory. An anonymous party that can reach the application and predict or obtain report paths could read sensitive cloud inventories, findings, IAM details, and a private key while a GCP scan is running.
Affected context
The issue occurs in deployments where the /scoutsuite-report static-file mount is reachable without the JWT authentication required by ordinary API routes. Generated ScoutSuite reports are retained in the served directory, and GCP scan processing may temporarily place an uploaded Google service-account JSON key there until the scan completes. Caller-selected or predictable report names may make relevant files easier to locate.
The issue occurs in deployments where the /scoutsuite-report static-file mount is reachable without the JWT authentication required by ordinary API routes. Generated ScoutSuite reports are retained in the served directory, and GCP scan processing may temporarily place an uploaded Google service-account JSON key there until the scan completes. Caller-selected or predictable report names may make relevant files easier to locate.
Exploit preconditions
- Attack surface: Network-reachable HTTP static-file endpoint
- Required access: No application authentication; the requester must be able to reach the CoPilot host
- Trigger point: A request for a report, result file, or temporary credential path under
/scoutsuite-report - Required state: A report must exist, or an admin- or analyst-initiated GCP scan must be processing the uploaded key
- Why exploitation is possible: Sensitive files are stored in a web-served directory without equivalent authentication and access controls
- Attack surface: Network-reachable HTTP static-file endpoint
- Required access: No application authentication; the requester must be able to reach the CoPilot host
- Trigger point: A request for a report, result file, or temporary credential path under
/scoutsuite-report - Required state: A report must exist, or an admin- or analyst-initiated GCP scan must be processing the uploaded key
- Why exploitation is possible: Sensitive files are stored in a web-served directory without equivalent authentication and access controls
Why this happens
The underlying issue is an authorization and storage-boundary failure. A directory containing cloud-security reports and temporary credentials is mounted as publicly accessible static content, while authentication is applied inconsistently to other application routes. This behavior maps primarily to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with related characteristics of missing authentication, insufficiently protected credentials, and exposure through a shared web-accessible directory.
The underlying issue is an authorization and storage-boundary failure. A directory containing cloud-security reports and temporary credentials is mounted as publicly accessible static content, while authentication is applied inconsistently to other application routes. This behavior maps primarily to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with related characteristics of missing authentication, insufficiently protected credentials, and exposure through a shared web-accessible directory.
Potential impact
- An attacker may obtain Google service-account private keys during active GCP scans
- Stolen credentials could allow unauthorized use of the service account's cloud permissions
- Attackers could read AWS, Azure, and GCP IAM principals, inventories, and security findings
- Cloud reconnaissance data could support lateral movement, privilege escalation, or targeted attacks
- Exposed reports may reveal sensitive organizational and infrastructure information
- An attacker may obtain Google service-account private keys during active GCP scans
- Stolen credentials could allow unauthorized use of the service account's cloud permissions
- Attackers could read AWS, Azure, and GCP IAM principals, inventories, and security findings
- Cloud reconnaissance data could support lateral movement, privilege escalation, or targeted attacks
- Exposed reports may reveal sensitive organizational and infrastructure information
General mitigation guidance
Mitigation generally focuses on separating secrets and reports from public web content and enforcing authorization consistently.
Common defensive patterns include:
- Keeping service-account keys outside all web-served directories
- Using in-memory or protected temporary storage for credentials, with prompt deletion and restricted permissions
- Requiring authentication and authorization for every report and result retrieval path
- Applying object-level access checks rather than relying on predictable filenames
- Using non-guessable identifiers and avoiding caller-controlled path construction
- Limiting service-account permissions through least privilege and short-lived credentials where supported
- Restricting report retention, access logging, and directory listing behavior
- Treating generated reports as sensitive artifacts with explicit access policies
Mitigation generally focuses on separating secrets and reports from public web content and enforcing authorization consistently.
Common defensive patterns include:
- Keeping service-account keys outside all web-served directories
- Using in-memory or protected temporary storage for credentials, with prompt deletion and restricted permissions
- Requiring authentication and authorization for every report and result retrieval path
- Applying object-level access checks rather than relying on predictable filenames
- Using non-guessable identifiers and avoiding caller-controlled path construction
- Limiting service-account permissions through least privilege and short-lived credentials where supported
- Restricting report retention, access logging, and directory listing behavior
- Treating generated reports as sensitive artifacts with explicit access policies
How teams detect issues like this
Detection can combine application review, runtime monitoring, and policy enforcement.
- Use static analysis to identify unauthenticated
StaticFilesmounts, public file-serving routes, and filesystem paths shared with credential-processing code. - Review code for uploaded secrets written beneath document roots, caller-controlled filenames, predictable defaults, and cleanup performed only after long-running jobs finish.
- Test every report and result endpoint without a session, including guessed names and paths, to verify authorization behavior.
- Monitor web access logs for anonymous requests to report directories, JavaScript result files, and files with credential-like names.
- Add CI policies that reject secrets stored under web roots and require authorization middleware for sensitive artifact routes.
- Use automated security review tools as a supplementary way to flag exposed directories and inconsistent authentication boundaries.
Detection can combine application review, runtime monitoring, and policy enforcement.
- Use static analysis to identify unauthenticated
StaticFilesmounts, public file-serving routes, and filesystem paths shared with credential-processing code. - Review code for uploaded secrets written beneath document roots, caller-controlled filenames, predictable defaults, and cleanup performed only after long-running jobs finish.
- Test every report and result endpoint without a session, including guessed names and paths, to verify authorization behavior.
- Monitor web access logs for anonymous requests to report directories, JavaScript result files, and files with credential-like names.
- Add CI policies that reject secrets stored under web roots and require authorization middleware for sensitive artifact routes.
- Use automated security review tools as a supplementary way to flag exposed directories and inconsistent authentication boundaries.
