JSON Code ‘Beautifiers’ Expose Sensitive Data From Banks, Government Agencies
It’s hard not to be a sucker for free stuff. Who doesn’t want something for nothing? Only that’s not how it actually works: There’s always a cost.
See Also: Agentic Commerce: The Technology Shaping the Future of Payments
Developers using online tools to “beautify” their JavaScript Object Notation have been pasting into them everything from authentication keys for code repositories, to Active Directory and database credentials, to personally identifiable information for banking customers, says a Tuesday report from threat intelligence firm watchTowr.
That’s based on the firm taking a close look at two free tools that top results for a search on “JSON beautify”: JSONFormatter and CodeBeautify.
JSON is the widely used, lightweight format designed for creating well-organized, easy to access data in a human-readable manner. For all things web services, clunky XML is out, lightweight JSON is in.
Beautification sites help users format, validate, save, convert and share JSON data. Both sites appear to be monetized through online advertising and affiliated marketing links.
When a user pastes data into either site and enriches it, what happens next depends. For anyone without an account, the enriched data gets posted publicly. Users who first create an account can restrict public access, flag code they’ve entered and beautified to expire after 24 hours, as well as generate a URL for someone to access their enriched JSON. All queries also get indexed on a “recent links” page on both sites, which doesn’t list the query itself, but rather a title, description and date tied to the saved content.
Unfortunately, the complete, enriched code turns out to be accessible with a modicum of effort, and certainly seems achievable by any advanced persistent teenager.
After using web crawling software to compile the title, ID and date of every saved item, researchers report that they wrote a script that submitted a simple HTTP POST command that successfully retrieved the stored, raw content for each ID, after which they quickly amassed an “overwhelming amount of data” from both sites.
This totaled five gigabytes of “enriched, annotated JSON data” collectively containing “thousands of secrets” spanning five years’ worth of JSONFormatter use and one year of CodeBeautify. All told, the researchers think 350,000 submissions might be exposed, but said they pulled the plug once they hit the 80,000 mark.
The Token Canary Is Choking
To test whether they were the only ones who spotted this data exposure, researchers uploaded canary tokens containing fake sensitive details to both services, and set the submissions to expire after 24 hours. 24 hours later, the canaries triggered, meaning that someone harvested the credentials before they expired and began testing them within 48 hours of their being uploaded.
“We’re not alone – someone else is already scraping these sources for credentials, and actively testing them,” the researchers said.
JSONFormatter and CodeBeautify didn’t immediately respond to a request for comment on the research or if they might take steps to better restrict access to enriched data.
Who uses a free JSON enrichment service? Exposed data appeared to include encrypted credentials for Mitre CoDev, which is a shared system used by Mitre for its partnership network. In other cases, researchers found working GitHub tokens, Amazon Web Services credentials for production environments and a bank’s Active Directory credentials.
Many things pasted into the JSON enrichment services weren’t even JSON. In one case, the researchers found a PowerShell BLOB – aka binary large object – containing over 1,000 lines of code, “designed to configure a new host from scratch, pulling down installers, configuring registry keys, hardening configurations and finally deploying a web app,” which appeared to have been built for use by “a well-known government entity.” Just to be clear, this is data that could give an attacker a leg up on attacking that organization.
The researchers also found Docker Hub, JFrog, Grafana and the Amazon Relational Database Service data for “a well-known ‘data lake-as-a-service’ vendor.” For a “major global bank,” they spotted working links to video recordings pertaining to “know your customer” checks from a specific country. Exposed bank data included the customer contact’s name, email address, mailing address, phone number and the video recording’s URL, which led to MP4 files which they didn’t view, but guessed would show someone holding up a government-issued ID card next to their face to prove their identity.
After discovering this data exposure, alerting the affected organizations appears to have been difficult, despite months of outreach attempts. Only “a few organizations (thank you) responded to us quickly,” the researchers said, including one well-known and publicly traded cybersecurity vendor – they didn’t name names – that exposed SSL certificate private key passwords, various internal passwords, both external and internal hostnames and IP addresses, as well as paths to various keys, certificates and configuration files. The vendor responded by saying all such messages needed to be submitted to its vulnerability disclosure program.
Exposed credentials obviously pose a significant risk in the hands of nation-state hackers or criminals. The Scattered Lapsus$ Hunters subgroup ShinyHunters, for example, has continued to unleash supply chain attacks, using stolen credentials for third-party services, to steal voluminous quantities of data. This past summer, the group breached a GitHub repository containing source code for Salesloft Drift’s chatbot, which they combed for OAuth tokens. This allowed them to access software integrated with Drift and to steal customer data from 760 Salesforce instances, which they held to ransom.
Researchers at watchTowr said they’re happy to share their data set with national computer emergency response teams or government agencies who contact them directly.
“As always, we want to remind everyone – if we can pull this off with our combined brain cell count of one, anyone can,” they warned.