21–30 of 394 posts
When I looked into it a while back, apparently it is intended behavior, which just seems odd.
This isn't a bug IMO. If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data. If you already have the data, there is no vulnerability - since you cannot learn anything you don't already have. If you got the hash from someone, you could likewise have gotten the data from them. People do need to be aware that 'some random hex string' in f…
You need to read to the end of the article where they show the brute-force way of getting the hashes.
This isn't a bug IMO. If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data. If you already have the data, there is no vulnerability - since you cannot learn anything you don't already have. If you got the hash from someone, you could likewise have gotten the data from them. People do need to be aware that 'some random hex string' in f…
> If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data. From the article, you do not need to have the data nor learn the hash from someone who had the data. > Commit hashes can be brute forced through GitHub’s UI, particularly because the git protocol permits the use of short SHA-1 values when referencing a commit. A short SHA-1 value…
This isn't a bug IMO. If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data. If you already have the data, there is no vulnerability - since you cannot learn anything you don't already have. If you got the hash from someone, you could likewise have gotten the data from them. People do need to be aware that 'some random hex string' in f…
I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
Edit: I popped this up because to me is absolutely miserable from a big company to just say: "Thanks, but we were aware of this".
Have we stopped naming vulnerabilities cute and fuzzy names and started inventing class names instead? Does this have a logo? Has this issue been identified anywhere else?
I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…
I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
Is my repository accessible?
Does any variant of this apply to DMCA’d repos in the repo network? For example if the root repo is DMCA’d, or, if repo B forks repo A, then B adds some stuff that causes B to get DMCA’d. Can A still access B?