ATLAS-EPIC Hardcoded Credentials Vulnerability

A vulnerability has been identified in the ATLAS-EPIC repository, specifically in the main branch, where hardcoded credentials are exposed in the auth/keys directory. This includes an unencrypted RSA private key and a client ID, both of which are publicly accessible. The private key can be used to authenticate with FHIR endpoints, potentially leading to unauthorized access to sensitive health information through Palantir Foundry data pipelines.

Impact

Exploitation of this vulnerability allows unauthorized access to protected FHIR data pipelines in Palantir Foundry, with the potential for disclosing sensitive health information.

Remediation

To address this vulnerability, remove the auth/keys directory from the repository and rotate the credentials by invalidating the old private key and client ID and generating new ones.