Airport Group Left API Keys in Client-Side JavaScript for Four Years

Overprivileged Access Enabled Mass Data Deletion

A major airport operator inadvertently exposed sensitive API credentials within its website code for nearly four years. A security researcher identified the flaw in client-side JavaScript files. The exposed keys belonged to Iterable, a marketing automation platform. This oversight potentially allowed unauthorized access to the personal data of 8.8 million customers. The vulnerability remained undetected until recently, highlighting significant gaps in routine code reviews.

The researcher discovered that the credentials possessed excessive permissions, often referred to as overprivileged access. These keys were embedded directly in the front-end code visible to users. Instead of being securely stored on the server side, they sat in plain sight within the browser environment. This architectural decision meant that anyone inspecting the page source could easily extract the keys. The exposure window spanned approximately 48 months, creating a prolonged period of potential risk for the organization’s digital infrastructure.

How Long Did the Vulnerability Persist?

The primary concern is not just data viewing, but the ability to modify or remove records. Because the Iterable credentials had high-level privileges, an attacker could have triggered bulk operations. Specifically, the researcher noted that the keys could enable mass deletion of customer profiles. This means a malicious actor could have wiped out millions of user accounts without immediate detection. The system lacked sufficient safeguards to prevent such drastic actions from a single compromised key. The lack of rate limiting or granular permission controls amplified the severity of the finding.

The use of client-side JavaScript for handling authentication logic is a common but risky practice. Developers often embed keys to simplify integration with third-party services. However, this approach fails to hide secrets from end-users. In this case, the airport group failed to rotate these keys regularly. They also did not segregate duties, granting the same high-level access to both read and write operations. This design choice turned a minor coding error into a critical security incident.

The flaw persisted for four full years before discovery. During this time, the keys remained active and functional. No evidence suggests that attackers actively exploited the gap during this entire period. However, the potential for damage existed continuously. The researcher emphasized that the duration of exposure significantly increases the likelihood of compromise. Even if no breach occurred, the organization faced substantial liability. The incident underscores the need for automated scanning tools in continuous integration pipelines. Such tools can detect hardcoded secrets before code reaches production environments.

Frequently Asked Questions

How many customer records were potentially exposed? Approximately 8.8 million customer records were accessible through the exposed credentials. The data included personal information managed by the marketing automation platform.

What specific action could an attacker take with these keys? An attacker could perform mass deletions of customer profiles. The overprivileged nature of the keys allowed for bulk modifications rather than just reading data.