🚨 Security finding affecting @Box
I identified an endpoint that exposes cryptographic keys (JWT private keys, JWT client_id and JWT client_secret) to a standard authenticated user. More importantly, the exposed keys are not merely static/configuration values — they appear to be functional and can be used to obtain valid access_token credentials for a account with email `AutomationUser_<REDACTED>@boxdevedition.com`.
The report was recently closed on HackerOne as a duplicate of an Informative report.
I believe the distinction is worth a second look: functional credential material capable of producing valid access tokens is significantly different from simply exposing non-sensitive configuration data.
I have a reproducible PoC and additional technical details.
DMs are open for the @Box security team.