Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can access deleted and private repository data on GitHub

trufflesecurity.com

Post reply on HN
Print view View original

131–140 of 394 posts

Re: Anyone can access deleted and private repository data on GitHub

#131

Post by SnowflakeOnIce »

andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]:

> A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork.

[1] https://docs.github.com/en/pull-requests/collaborating-with-...

Re: Anyone can access deleted and private repository data on GitHub

#133

Post by galkk »

I won't be surprised if "right to be forgotten"/GDPR abusers will spam github and force them to act on it, eventually.

----

This is clearly documented and can be explained even to non-technical managers.

From my POV calling that vulnerability is trying to build a hype.

I think that having quote from here on visibility changing settings page would be even more clear: https://docs.github.com/en/pull-requests/collaborating-with-...

Re: Anyone can access deleted and private repository data on GitHub

#134

Post by debugnik »

hyperpape wrote: post #83
dogleash wrote: post #68

Earlier quoted context omitted.

> git is based on content addressable storage, so it makes sense that anything that is every public will never disappear. No. That doesn't make sense. It only sounds vaguely plausible at first because content addressable storage often means a distributed system where hosting nodes are controlled by multiple parties. That's not the case here, we're only talking about one host. Imagine we were talking about a (hypothet…

Since Netflix neither allows anonymous users to fully download Frozen without DRM, nor allows authorized users to upload derivative works that are then redistributed to the public, I think there may be some relevant differences here.

They do remove content when their licence expires, though. So imagine instead Netflix allowing users to find and watch expired series by hash, then telling the copyright owners they can't fully delete the series because something something content-addressing.

Re: Anyone can access deleted and private repository data on GitHub

#135

Post by madeofpalk »

andrewinardeer wrote: post #110
madeofpalk wrote: post #101

Earlier quoted context omitted.

The point of a bug bounty is for companies to find new security problems. If the (class of) problem is already known, it’s not worth rewarding.

If a renown company won't pay a bug bounty, a foreign government often will.

Why would a foreign government pay for a commonly known security limitation of a product?

Re: Anyone can access deleted and private repository data on GitHub

#136

Post by crvdgc »

I think the first two points are a result of private data (commit/fork/issue) being able to refer to public data without making the reference public.

Say a private commit depends on a public commit C. Suppose in the public repo, the branch containing C gets deleted and C is no longer reachable from the root. From the public repo's point-of-view, C can be garbage-collected, but GitHub must keep it alive, otherwise the deletion will break the private commit.

It would be "a spooky action at a distance" from the private repo's POV. Since the data was at a time public, the private repo could have just backed up everything. In fact, if that's the case, everyone should always backup everything. GitHub retaining the commit achieves the same effect.

The public repo's owner can't prevent this breakage even if they want to, because there's no way to know the existence of this dependency.

The security issue discussed in the post is a different scenario, where the public repo's owner wants to break the dependency (making the commit no longer accessible). That would put too much of a risk for anyone to depend on any public code.

My mental model is that all commits ever submitted to GitHub will live forever and if it's public at one time, then it will always be publicly accessible via its commit hash.

Re: Anyone can access deleted and private repository data on GitHub

#137

Post by SnowflakeOnIce »

LeifCarrotson wrote: post #49

IMO, the real vulnerability here is the way the Github Events archive exposes the SHA1 hashes of the vulnerable repositories. It would be easy to trawl the entire network to access these deleted/private repositories, but only because they have a list of them. Similar (but less concerning) is the ability to use short SHA1 hashes. You'd have to either be targeting a particular repository (for example, one for which a m…

'git clone --mirror' seems to pull down lots of additional content also.

Re: Anyone can access deleted and private repository data on GitHub

#138

Post by Manuel_D »

SnowflakeOnIce wrote: post #131
andersa wrote: post #4

I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All forks of public repositories are public. You cannot change the visibility of a fork. [1] https://docs.github.com/en/pull-requests/collaborating-with-...

Not through the GitHub interface, no. But you can copy all files in a repository and create a new repository. IIRC there's a way to retain the history via this process as well.

Re: Anyone can access deleted and private repository data on GitHub

#139

Post by Cpoll »

tptacek wrote: post #117
giobox wrote: post #106

Earlier quoted context omitted.

> As the article pointed out, GitHub already publicly documented this vulnerability. I'm honestly not yet convinced that is enough here - I've fallen victim to this without realizing it - the behaviour here is so far removed from how I suspect most user's mental model of github.com works. For me none of the exposed data is sensitive, but the point remains I was totally unawares it would be retrievable like this. If t…

The problem with this line of argument is that the fundamental workings of git are also surprising to people, such that they routinely attempt to address mistaken hazmat commits by simple reverts. If at bottom this whole story is just that git is treacherous, well, yeah, but not news. There's a deeper problem here, which is that making the UX on hosting sites less surprising doesn't fix the underlying problem. There…

Is "git" relevant here? Forking isn't a git concept, and none of this behaviour has much to do with git; it's all GitHub.

Also, you can revoke an API key, but you can't revoke a company-proprietary algorithm that you implemented into a fork of a public project.

Re: Anyone can access deleted and private repository data on GitHub

#140

Post by the8thbit »

stvltvs wrote: post #50
chrisandchris wrote: post #47

Earlier quoted context omitted.

Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.

Which vendors work best for private projects?

I've used both Bitbucket and Azure in the corporate world.
Post reply on HN