AutoLib Software Systems OPAC API Key Exposure Vulnerability

A vulnerability exists in AutoLib Software Systems OPAC version 20.10, where multiple API keys are exposed in the source code. This exposure allows attackers to access the backend API or other sensitive information. The vulnerability was introduced in the main.js file.

Impact

The exposure of API keys can lead to unauthorized access to the backend API and potentially sensitive information.

Reproduction

After obtaining the exposed API keys, an attacker can use tools like curl, Postman, or custom scripts to send unauthorized requests to the target API.

Remediation

The vendor released a fix for this vulnerability on September 25, 2024.