Sensitive API keys are exposed within the administrative interface of RansomLook, creating a significant risk of unauthorized access and data compromise.

This is an exposure of sensitive information (CWE-200) and insufficient credential protection (CWE-522) where full API tokens are inadvertently included in hidden form fields and page source, accessible to authenticated administrative users.

Exposure of these API keys allows any actor with access to the administrative page source to obtain full credentials, which can then be used to impersonate administrative functions. With a CVSS score of 9.4, the potential for unauthorized access to private data and system control is critical, necessitating urgent remediation to prevent account takeover.

Immediate Action: Update to the latest version of RansomLook, which replaces raw API keys with secure, SHA-256-derived opaque handles to prevent disclosure.

Proactive Monitoring: Review audit logs for any suspicious API usage or unauthorized authentication events that might correlate with the potential exposure of these tokens.

Compensating Controls: Ensure that access to the administrative interface is strictly limited to authorized personnel and protected by additional network-level controls like VPNs or IP whitelisting.

Public Exploit Available: No (exploit_available: false)

This vulnerability is highly severe due to the risk of credential theft and subsequent unauthorized system access. Organizations should apply the provided patch immediately and perform a rotation of all existing API keys that may have been exposed through this mechanism.