How I reported Google Map API key leak

 Hello Folks,  Sourav from this side. Hope you all are in a great health and doing awesome. I am security enthusiast and bug bounty hunter from India. Today I will discuss about one of report where I reported GMap API key leak to a Bugcrowd's private program.

So let's get started without wasting any time...

So I was hunting on a private program and for the sake of this blog we will use example.com as I am not allowed to disclose the name of the website. 

During my recon process I got a lots of different subdomain for example.coma and one of them was event.example.com. I started traversing the host to look for different functionalities. I usually do the view-source of almost every page. Suddenly this particular view-source page caught my eyes -

Now the above script tag is revealing the Google Map API key. 

Tip - Whenever you get an API key and you don't know how to use it. Follow this awesome repository.

GMap API key leaks... Does it matter??

First of all let me tell you something not all API keys reveals sensitive information but still they have some security impact which we will discuss.

Now if your Google Maps API keys is not restricted properly than someone with API key can make unauthorized calls . So someone can embed your API keys on their project like this -

Here I can use the API keys to make request with Staticmap API. 

I also tried to the API keys with other GMap APIs like Google Place API but they were properly restricted for unauthorized use -

It is strictly recommended that you should restrict your API key to prevent unauthorized use of your API key. For info about restricting Gmap API key Visit.

Tip - When testing the key and key is restricted in one service like Google Place. Try it in all of other service. Like in my case it is not restricted in Staticmap API.

Fine....But what's the impact??

Okay this is not revealing any sensitive data about the victim. But someone having your API key can increase your Bill. For more info on pricing chart for Google Maps APIs see here.

So basically unauthorized user can consume the company's monthly quota and do financial damage if the company don't have any limitation settings on the budget.

There is one thing, Companies can implement a cap on their monthly quote of API calls. For more info  on cap see here

But since there is a limitation present on the API calls than in this case we  can trigger DoS attack. This will hamper the services of the websites which were using Google Maps and hence will hamper User Experience.

That's all for today Folks. You can send and feedback on my LinkedIN or just send a hi.

Till then...

Stay Hydrated and Keep Hacking!!