Executive brief
Worksnaps, a time-tracking and remote work verification tool, was found to contain hardcoded administrative credentials within its desktop application. These credentials granted full 'root' access to the company's cloud infrastructure, potentially allowing unauthorized individuals to view sensitive data such as screenshots of users' desktops and internal server configurations. An attacker could extract these secrets from the software and use them to access or disrupt the company's production cloud environment.
Technical details
The Worksnaps client application binaries (e.g., procUploadDirect.net45.v2.exe) contained hardcoded AWS access keys and secret keys. Analysis using tools like ILSpy revealed that these credentials authenticated as the AWS account root identity. This granted an attacker the ability to enumerate S3 buckets, describe EC2 instances, and download sensitive objects (such as user desktop screenshots) directly from production storage. While the vendor released a patch (1.6.20260201) that revokes the root keys and moves to a server-side credential dispatch model, researchers noted that some lower-privileged hardcoded credentials may still persist in newer binaries.
Affected products
- Silver Leaf Technologies, Inc. (Worksnaps.net) Worksnaps Client before 1.6.20260201
Timeline
- 2025-05-21: disclosed: Vulnerability discovered by SEC Consult
- 2025-12-12: patched: Vendor informed researchers that a new version was available
- 2026-06-18: advisory: Public advisory and CVE published