On the positive side this takes care of all those companies forking open source software and not contributing back
Anyone can access deleted and private repository data on GitHub
61–70 of 394 posts
Re: Anyone can access deleted and private repository data on GitHub
#62In response to the end of the article "it’s important to note that some of these issues exist on other version control system products." I actually have experience helping someone with an issue on BitBucket with PII data that you can't rotate.
Once we eliminated the references in the tree and all forks (they were all private thankfully), we reached out to BitBucket support, and they were able to garbage collect those commits, and purge them to the point where even knowing the git hashes they were not locatable directly.
Re: Anyone can access deleted and private repository data on GitHub
#63even better you can actually commit to other forks if they creates pull request to you.
(there is checkbox allowing that when you are opening PR that I bet almost noone noticed)
I reported that years ago and all they changed it that they extended documentation about this "feature"
my main issue was that you cannot easily revoke this access because target repo can always reopen PR and regain write access.
but they basically "stated works as intended"
Re: Anyone can access deleted and private repository data on GitHub
#64This is why for private and business projects, we don't use GitHub, we use Amazon CodeCommit.
The article states that this “vulnerability” might exist in other scm systems as well
Re: Anyone can access deleted and private repository data on GitHub
#65Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate
> I'll be calling "private" repos "unlisted"
The same for “deleted” repos.
Re: Anyone can access deleted and private repository data on GitHub
#66I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…
I didn't find anything mentioning it online at the time. But there wasn't much time and dedication involved either, to be fair. I discovered it completely on accident when I combined a commit hash from my local client with the wrong repository url and it ended up working.
Re: Anyone can access deleted and private repository data on GitHub
#67Earlier quoted context omitted.
> If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data. From the article, you do not need to have the data nor learn the hash from someone who had the data. > Commit hashes can be brute forced through GitHub’s UI, particularly because the git protocol permits the use of short SHA-1 values when referencing a commit. A short SHA-1 value…
In which case, yeah, thats a vulnerability. They shouldn't allow a short hash to match up against anything but public data.
It's common to use short hash in pull request, and then modify or rebase the commits.
The solutions are:
* Force people to use the full hash.
* Get use to a lot of dead links.
* Claim that it's a feature, not a bug.
Re: Anyone can access deleted and private repository data on GitHub
#68Surprised at the comments minimizing this. I've used github for a long time, would not have expected these results, and was unnerved by them. I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.
For the first two, git is based on content addressable storage, so it makes sense that anything that is ever public will never disappear. I can sympathize with someone who gets bit by it, as it might not have occurred to them, but it’s part of the model. The third strikes me as counter-intuitive and hard to reason about. P.S. If you publish your keys or access tokens for well known services to GitHub and you are prom…
> git is based on content addressable storage, so it makes sense that anything that is every public will never disappear.
No. That doesn't make sense. It only sounds vaguely plausible at first because content addressable storage often means a distributed system where hosting nodes are controlled by multiple parties. That's not the case here, we're only talking about one host.
Imagine we were talking about a (hypothetical) NetFlix CDN where it's content addressed rather than by UUID. Would anyone say "they forgot to check auth tokens for Frozen for one day, therefore it makes sense that everyone can watch it for free forever"?
Re: Anyone can access deleted and private repository data on GitHub
#69I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
Honest question. Submitting these types of bugs only to get a: "we have determined it is known low risk issue..." seems like they really don't want to pay for someone else's time and dedication in making their product safer. If they knew about this, was this disclosed somewhere? If not I don't see them playing a fair game. What's the motivation to do this if in the end they can have the final decision to award you or…
Security disclosures are like giving someone an unsolicited gift. The receiver is obligated to return the favor.
But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.
Re: Anyone can access deleted and private repository data on GitHub
#70This is why for private and business projects, we don't use GitHub, we use Amazon CodeCommit.
Because of literally this issue? I'm not sure if you're doing a generic "I don't like github" or know for a fact that CodeCommit doesn't have issues like this.
This seems like a terrible security vector but I'm not sure migrating thousands of repos out of github vs. training engineers to keep public and private repos completely separated makes sense and you haven't explained why you use CodeCommit.
Unless it is this reason, which like I said, seems a bit heavy handed, but I rarely move private repos to public.
I kind of assumed this was a distributed Git problem, not Github, but I don't know.