A researcher has disclosed the details of a series of vulnerabilities that could have been exploited by an attacker to access an organization’s private pages on GitHub.
GitHub Pages is a service that individuals and organizations can use to host websites. The sites can be hosted on a custom domain or the github.io domain, and the code for the website is taken directly from a private or public GitHub repository. The pages themselves can also be private or public.
Over the weekend, researcher Robert Chen published a blog post detailing a chain of vulnerabilities he and another white hat hacker discovered last year in GitHub Pages.
The issue was reported in May 2020 and patched in June 2020. GitHub assigned the exploit a high severity rating and awarded the researchers $20,000, as well as a $15,000 bonus, which is one of the highest bug bounties awarded by the company.
According to Chen, the exploit was related to the authentication flow used for private pages and involved an uncommon type of vulnerability called Carriage Return Line Feed (CRLF) injection, which led to a cross-site scripting (XSS) attack. A cache poisoning issue could have allowed an attacker to get the XSS payload cached and delivered to users who haven’t directly interacted with it — triggering an XSS vulnerability typically requires the target to access a malicious link or page.
The attack also involved what the researcher described as “public-private pages,” which refers to public repositories having “private” pages. This can occur when an organization has a private repository with a private page but later decides to make the repository public — the associated page remains “private,” but it’s actually public to everyone.
The researchers determined that an unprivileged attacker from outside the targeted organization could abuse such public-private pages to “compromise internal private pages’ authentication flows.” A malicious actor could have launched an XSS attack on an employee of the targeted organization and from there pivot to private pages within the organization.
In response to a Hacker News (Y Combinator) post describing Chen’s findings, the GitHub Pages team shared some information about the issues it uncovered while investigating this vulnerability report.
Related: Google Discloses Details of GitHub Actions Vulnerability
Related: Serious Vulnerability in GitHub Enterprise Earns Researcher $20,000
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
