Uploadcare Private Key Exposure in campusconnect.ucc 14.3.5 Leading to Unauthorized File Operations and Potential RCE

Based on the webpage screenshot provided by the user, I have extracted the following key information: 1. Vulnerability Overview: Title: Uploadcare Private Key Exposure Leading to Unauthorized File Operations and Potential RCE in campusconnect.ucc. Description: The Android application version 14.3.5 contains a hardcoded Uploadcare private key. Impact: An unauthorized attacker who obtains this key can directly invoke the Uploadcare API to upload, list, download, and delete files stored in the Uploadcare bucket. This may lead to sensitive information disclosure and permanent data loss. Furthermore, if an attacker uploads a malicious file and the affected web server subsequently downloads and processes that file, it could result in Remote Code Execution (RCE). 2. Affected Scope: Application Name: Application Version: 14.3.5 Affected Component: Uploadcare private key (hardcoded in the package of ). 3. Remediation: Although the screenshot does not explicitly list a "Remediation" section, based on the vulnerability description (hardcoded key), the standard remediation is to remove the hardcoded private key and instead perform file operations through secure means (such as a backend API proxy), or rotate the key. 4. POC/Exploit Code: The "Step To Reproduce" section in the screenshot contains a code block demonstrating the hardcoded key. * Code content: (Note: The value appears to be redacted, masked, or truncated in the screenshot, represented here as placeholder zeros.)

Goal Reached Thanks to every supporter — we hit 100%!

Uploadcare Private Key Exposure in campusconnect.ucc 14.3.5 Leading to Unauthorized File Operations and Potential RCE