Anyone can access deleted and private repository data on GitHub

Post by deepsun » Tue, Jul 30, 2024, 5:24 PM UTC

raesene9 wrote: post #298

tptacek wrote: post #111

Earlier quoted context omitted.

No large company running a bug bounty cares one iota about stiffing you on a bounty payment. The teams running this programs are internally incentivized to maximize payouts; the payouts are evidence that the system is working. If you're denied a payment --- for a large company, at least --- there's something else going on. The thing to keep in mind is that large-scale bug bounty programs make their own incentive weat…

In my (admittedly limited) experience, whilst payouts for bugs might be seen as a positive internally, payments for bad architecture/configuration choices are less so (perhaps as they're difficult to fix, so it's politically not expedient to raise them internally). To provide one example I reported to a large cloud provider that their managed Kubernetes system exposed the Insecure port to the container network, meani…

Post by infinite8s » Sun, Aug 04, 2024, 1:02 PM UTC

ajross wrote: post #346

beezlewax wrote: post #94

Earlier quoted context omitted.

There's a whole section here about how to brute force the hashs. You don't even need the full hash... just a shortened version using the first few chars.

I'm dubious. Searching for globally unique commit IDs is still a least a million+ request operation. That's easy enough in a cryptographic sense but the attack in question requires banging a web UI, which is 100% for sure going to hit some abuse detector. I really don't think you can do this in practice, and the article certainly doesn't demonstrate it.