Over 50,000 Stripe API keys exposed, highlighting fraud risks

Over 50,000 Stripe API keys have been exposed across public code repositories, GitHub Actions logs, and misconfigured web servers, demonstrating the immediate risks of leaked credentials. Researchers from Ransomnews confirmed that a significant portion of these keys remain active and can be exploited by malicious actors within hours to facilitate fraud, gain unauthorized data access, and abuse accounts, as reported by Security Affairs.

The exposed Stripe API keys, numbering over 50,000, pose a severe security threat. Researchers successfully used a sample of active keys to access merchant customer lists, create fraudulent payment links, and initiate test charges within 17 hours. A compromised secret key grants extensive access, including the ability to list customers, create charges, issue refunds, modify webhook endpoints, and potentially access connected accounts via Stripe Connect. The primary sources of these leaks include hardcoded keys in public and private GitHub repositories, sensitive information inadvertently printed in GitHub Actions build logs, and keys found on misconfigured web servers.

While Stripe offers automatic scanning for public repositories, its effectiveness is limited by low opt-in rates and lack of coverage for private repositories and other exposure vectors. Merchants are advised to audit their keys, rotate any that have touched public code or logs, implement restricted keys for integrations, and enable Stripe Radar for fraud detection.

Source: Security Affairs