Anyone can access deleted and private repository data on GitHub • Hacker News Board

Re: Anyone can access deleted and private repository data on GitHub

#31

Post by kayodelycaon » Wed, Jul 24, 2024, 7:34 PM UTC

liendolucas wrote: post #25

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…

As the article pointed out, GitHub already publicly documented this vulnerability.

My employer doesn't pay out for known security issues, especially if we have mitigating controls.

A lot of people spam us with vulnerability reports from security tools we already use. At least half of them turn out to be false positives we are already aware of. In my opinion, running a bug bounty program at all is a net negative for us. We aren't large enough to get the attention of anyone competent.

Re: Anyone can access deleted and private repository data on GitHub

#32

Post by [deleted] » Wed, Jul 24, 2024, 7:34 PM UTC

mmsc wrote: post #26

>This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR) Have we stopped naming vulnerabilities cute and fuzzy names and started inventing class names instead? Does this have a logo? Has this issue been identified anywhere else?

[deleted]

Re: Anyone can access deleted and private repository data on GitHub

#33

Post by ilikehurdles » Wed, Jul 24, 2024, 7:34 PM UTC

cxr wrote: post #6

> The implication here is that any code committed to a public repository may be accessible forever That's exactly how you should treat anything made available to the public (and there's no need for the subsequent qualifier that appears in the article—" as long as there is at least one fork of that repository ").

Sometimes I wonder if all the security features GitHub slathers on top of `git` lull people into a false sense of security when fundamentally they're working in a fully distributed version control system with no centralized authority. If your key is leaked the solution is to invalidate the key not just synthetically alter your version of history to pretend it never happened.

Re: Anyone can access deleted and private repository data on GitHub

#34

Post by hyperpape » Wed, Jul 24, 2024, 7:34 PM UTC

jonahx wrote: post #17

Surprised at the comments minimizing this. I've used github for a long time, would not have expected these results, and was unnerved by them. I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.

For the first two, git is based on content addressable storage, so it makes sense that anything that is ever public will never disappear.

I can sympathize with someone who gets bit by it, as it might not have occurred to them, but it’s part of the model.

The third strikes me as counter-intuitive and hard to reason about.

P.S. If you publish your keys or access tokens for well known services to GitHub and you are prominent enough, they will be found and exploited in minutes. The idea that deleting the repository is a security measure is not really worth taking seriously.

Re: Anyone can access deleted and private repository data on GitHub

#35

Post by jonahx » Wed, Jul 24, 2024, 7:38 PM UTC

liendolucas wrote: post #25

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…

Not defending GH here (their position is indefensible imo) but, as the article notes, they document these behaviors clearly and publicly:

https://docs.github.com/en/pull-requests/collaborating-with-...

I don't think they're being underhanded exactly... they're just making a terrible decision. Quoting from the article:

> The average user views the separation of private and public repositories as a security boundary, and understandably believes that any data located in a private repository cannot be accessed by public users. Unfortunately, as we documented above, that is not always true. Whatsmore, the act of deletion implies the destruction of data. As we saw above, deleting a repository or fork does not mean your commit data is actually deleted.

Re: Anyone can access deleted and private repository data on GitHub

#36

Post by jeremyjh » Wed, Jul 24, 2024, 7:38 PM UTC

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

It would not even be that hard to fix it; private forks should always just be automatically copied on first write. You might lose your little link to the original repo, but that's not as bad as unintentionally exposing all your future content.

Re: Anyone can access deleted and private repository data on GitHub

#37

Post by 93po » Wed, Jul 24, 2024, 7:39 PM UTC

liendolucas wrote: post #25

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…

companies vary wildly in their honesty and cooperation with bug bounties and develop reputations as a result. if they have a shit reputation, people stop doing free work for them and instead focus on more honest companies

Re: Anyone can access deleted and private repository data on GitHub

#38

Post by [deleted] » Wed, Jul 24, 2024, 7:39 PM UTC

liendolucas wrote: post #25

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…

[deleted]

Re: Anyone can access deleted and private repository data on GitHub

#39

Post by andersa » Wed, Jul 24, 2024, 7:42 PM UTC

kayodelycaon wrote: post #29

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

What does "private fork" mean in this context? I created a fork of a project by cloning it to my own machine and set origin to an empty private repository on GitHub. I manually merge upstream changes on my machine. Is my repository accessible?

No, that would be the "copy the repository" approach. Private fork is when you do it through their UI.

As far as I know, it is not accessible.

Re: Anyone can access deleted and private repository data on GitHub

#40

Post by jonahx » Wed, Jul 24, 2024, 7:43 PM UTC

hyperpape wrote: post #34

jonahx wrote: post #17

Surprised at the comments minimizing this. I've used github for a long time, would not have expected these results, and was unnerved by them. I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.

For the first two, git is based on content addressable storage, so it makes sense that anything that is ever public will never disappear. I can sympathize with someone who gets bit by it, as it might not have occurred to them, but it’s part of the model. The third strikes me as counter-intuitive and hard to reason about. P.S. If you publish your keys or access tokens for well known services to GitHub and you are prom…

I agree the 3rd is by far the worst of the offenders. But even the first two should have more visibility. For example, by notifying users during deletion of forked repos that data will still be available.

The exact UX here is debatable, but I don't think security warnings buried in the docs is enough. They should be accounting for likely misunderstandings of the model.