A researcher has disclosed the details of a series of vulnerabilities that could have been exploited by an attacker to access an organization’s private pages on GitHub.
GitHub Pages is a service that individuals and organizations can use to host websites. The sites can be hosted on a custom domain or the github.io domain, and the code for the website is taken directly from a private or public GitHub repository. The pages themselves can also be private or public.
Over the weekend, researcher Robert Chen published a blog post detailing a chain of vulnerabilities he and another white hat hacker discovered last year in GitHub Pages.
The issue was reported in May 2020 and patched in June 2020. GitHub assigned the exploit a high severity rating and awarded the researchers $20,000, as well as a $15,000 bonus, which is one of the highest bug bounties awarded by the company.
According to Chen, the exploit was related to the authentication flow used for private pages and involved an uncommon type of vulnerability called Carriage Return Line Feed (CRLF) injection, which led to a cross-site scripting (XSS) attack. A cache poisoning issue could have allowed an attacker to get the XSS payload cached and delivered to users who haven’t directly interacted with it — triggering an XSS vulnerability typically requires the target to access a malicious link or page.
The attack also involved what the researcher described as “public-private pages,” which refers to public repositories having “private” pages. This can occur when an organization has a private repository with a private page but later decides to make the repository public — the associated page remains “private,” but it’s actually public to everyone.
The researchers determined that an unprivileged attacker from outside the targeted organization could abuse such public-private pages to “compromise internal private pages’ authentication flows.” A malicious actor could have launched an XSS attack on an employee of the targeted organization and from there pivot to private pages within the organization.
In response to a Hacker News (Y Combinator) post describing Chen’s findings, the GitHub Pages team shared some information about the issues it uncovered while investigating this vulnerability report.
Related: Google Discloses Details of GitHub Actions Vulnerability
Related: Serious Vulnerability in GitHub Enterprise Earns Researcher $20,000
