Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mintlify GitHub read/write token leak

mintlify.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Mintlify GitHub read/write token leak

#31

Post by oefrha »

madeofpalk wrote: post #27
oefrha wrote: post #26

Earlier quoted context omitted.

Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1] > In general, GitHub Apps are preferred over OAuth apps. [1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

"Always" is doing a lot of work here. Github Apps are relatively new.

If half a decade is new, sure. Except I was replying to someone claiming “I don't think GitHub will ever learn”, commenting on an article from a company created in 2021.

Re: Mintlify GitHub read/write token leak

#34

Post by junon »

oefrha wrote: post #26
junon wrote: post #25

Earlier quoted context omitted.

This is pretty typical of GitHub, unfortunately. They have terrible scoping and don't give developers the option to even give users that flexibility. It's been like this for over a decade, I don't think GitHub will ever learn.

Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1] > In general, GitHub Apps are preferred over OAuth apps. [1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

Even with apps, you still do not have the fine grained permissions you'd think you'd get. Have you tried?

Re: Mintlify GitHub read/write token leak

#35

Post by Ruepler »

theK wrote: post #29

Did I miss it or does the announcement completely evade explaining HOW the tokens actually leaked?

Yea it does. It most likely is related to MDX documents beeing susceptible to XSS attacks. Having worked at mintlify last year I can tell you that this is not surprising at all and I've been warning them extensively of sth like this happening.

Re: Mintlify GitHub read/write token leak

#36

Post by hanyiwang »

theK wrote: post #29

Did I miss it or does the announcement completely evade explaining HOW the tokens actually leaked?

This is Han, I'm one of the co-founders from Mintlify.

For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post.

The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response contained our internal admin tokens, which can then be used to access internal endpoints, which unveiled sensitive user information.

Our initial patch upon discovering the incident fixed the response of the vulnerable endpoint, but we have since also implemented a sweeping number of security provisions and are also in the process of completely deprecating the admin tokens and GitHub OAuth entirely to prevent an incident like this from ever happening again.

Re: Mintlify GitHub read/write token leak

#37

Post by Ruepler »

nostrowski wrote: post #21

Unfortunate, but impressed by how the Mintlify team is handling it.

They are claming that they resolved the vulnerability that caused the token leak but don't mention it. Doesn't exactly seem transparent to me or like handling it well.

I was contracting for them last year and tried, among other things to build an actual engineering culture that prevents and fixes issues that accumulate to catastrophic incidents like this.

They generally prefer to "ship fast".

I informed them very thoroughly again on January 13th (3+ months after they terminated me for "cultural differences"), because I was worried of this exact nightmare scenario happening very soon.

The reason for this was that they open sourced a package that let's an attacker easily practice and test locally in like a minute.

MDX exposes to Cross site Scripting easily. I assume this is the "fixed vulnerability" they are talking about, just to be transparent.

Re: Mintlify GitHub read/write token leak

#38

Post by Ruepler »

hanyiwang wrote: post #36
theK wrote: post #29

Did I miss it or does the announcement completely evade explaining HOW the tokens actually leaked?

This is Han, I'm one of the co-founders from Mintlify. For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post. The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response cont…

>"we've decided to leave out the technical details of the breach in the blog post"

>"Our dedication to transparency, security, and the trust you place in us remains unwavering."

You are contradicting yourself here.

>"The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response contained our internal admin tokens, which can then be used to access internal endpoints, which unveiled sensitive user information."

Why would you leave that out? Seems like it is vital information.

Re: Mintlify GitHub read/write token leak

#39

Post by ummonk »

hanyiwang wrote: post #36
theK wrote: post #29

Did I miss it or does the announcement completely evade explaining HOW the tokens actually leaked?

This is Han, I'm one of the co-founders from Mintlify. For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post. The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response cont…

> For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post.

This doesn't exactly inspire confidence that your service is now secure.

Re: Mintlify GitHub read/write token leak

#40

Post by oefrha »

junon wrote: post #34
oefrha wrote: post #26

Earlier quoted context omitted.

Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1] > In general, GitHub Apps are preferred over OAuth apps. [1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

Even with apps, you still do not have the fine grained permissions you'd think you'd get. Have you tried?

With apps, you can certainly grant access to individual repos instead of all repos. Yes I’ve tried.

Here’s how this thread went:

brycelarkin: Mintlify’s GitHub app asked for permissions to access all my repos.

You: Developers don’t have the option to not access all repos.

Me: False. GitHub apps do have fine grained permissions, as in they don’t have to have to access all repos.

You: Even with apps you don’t have fine grained permissions “you’d think you’d get”.

So what are you talking about? What’s the thing I’d think I’d get but not getting and how is that related to “permissions to access all repos” as discussed here?

Post reply on HN