Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

11–20 of 240 posts

Re: Hacked: commit to rails master on GitHub

#11

Post by [deleted] »

atambo wrote: post #3
arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

I think it's a mass assignment vulnerability: https://github.com/rails/rails/issues/5228

[deleted]

Re: Hacked: commit to rails master on GitHub

#13

Post by swanson »

phillmv wrote: post #9
arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

He registered a commit using his own account - so he either got the password of a rails admin or he must've found a way to add his keys to the rails github account directly. The comments on the commit mention he just raised an issue that few people protect the attributes on their models from mass assignment, which… is one way this could happen. Kind of a dick move, though. Responsible disclosure, doing it on a Sunday…

It could be far less nefarious than getting passwords or adding SSH keys. If, e.g. the `repo_id` attribute is not protected (and there are no further authorization checks), he could just send a POST and set the repo_id to the Rails project instead of his own repo and his commit could be pushed to master.

Re: Hacked: commit to rails master on GitHub

#14

Post by pyre »

atambo wrote: post #3
arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

I think it's a mass assignment vulnerability: https://github.com/rails/rails/issues/5228

Relevant:

  What I want you to see in that thread I mentioned is the
  way the core team perceives this. You are not discovering
  anything unknown, we already know this stuff and we like
  attr protection to work the way it is.
Looks like this guy got really frustrated with the Rails devs basically saying that he didn't know what he was talking about. This reminds me of all of the unsafe defaults that PHP used to have. Same justification too, "it's a config setting, so it's up to the developer/sysadmin to read the docs and set them right."

Re: Hacked: commit to rails master on GitHub

#15

Post by phillmv »

psadauskas wrote: post #10
klodolph wrote: post #8

If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.

One of the first comments is a link to where he tried, but the issue was repeatedly closed.

He submitted it to… the rails bug tracker. Three days ago. That's not disclosing the issue to GitHub at all.

Re: Hacked: commit to rails master on GitHub

#18

Post by bobx11 »

atambo wrote: post #3
arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

I think it's a mass assignment vulnerability: https://github.com/rails/rails/issues/5228

This guy brought up the vulnerability and the maintainers didn't seem to take it seriously since he wasn't articulate enough or was not approaching them with enough respect maybe for their liking? I wish they would have kissed his ass a little to get the low-down on the vulnerability so I didn't have to worry about my company's private github repos. He deserves props for bring it up for discussion.

Re: Hacked: commit to rails master on GitHub

#19

Post by martingordon »

arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

It's a vulnerability in Rails, which is what GitHub is built on.

The vulnerability was demonstrated by adding a commit to the Rails project on GitHub, indicating that GitHub suffers from the vulnerability.

Here's the relevant issue. It might clarify things a bit better: https://github.com/rails/rails/issues/5228

Post reply on HN