Mintlify GitHub read/write token leak • Hacker News Board

Re: Mintlify GitHub read/write token leak

#41

Post by hanyiwang » Mon, Mar 18, 2024, 3:13 AM UTC

ethanwillis wrote: post #24

I reported security issues to Mintlify back when they used Discord for support. Gave recreation steps. Never got any feedback that looked to me like they were looking into it. I reported similar issues to what's described in May 2023.

Hey Ethan! Han from Mintlify here.

It's been awhile I hope you're doing well!

The vulnerability issue that you reported, if I recall correctly, was relating to server-forwarding attacks via our API playground. We've addressed that issue around 8 months ago, and unfortunately, it was not the root of this incident.

Please correct me if I am wrong though!

Re: Mintlify GitHub read/write token leak

#42

Post by Ruepler » Mon, Mar 18, 2024, 7:19 AM UTC

ummonk wrote: post #39

hanyiwang wrote: post #36

Earlier quoted context omitted.

This is Han, I'm one of the co-founders from Mintlify. For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post. The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response cont…

> For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post. This doesn't exactly inspire confidence that your service is now secure.

It's most likely not. Not sure if this was intentional but they pretty much confirmed it in a reddit thread:

> ... and are also in the process of completely deprecating the admin tokens for a more secure internal authentication procedure. Not to mention, we're also looking to fully deprecate the need of the GitHub OAuth tokens entirely in the coming weeks.

https://www.reddit.com/r/cscareerquestions/comments/1bh22bq/...

Re: Mintlify GitHub read/write token leak

#43

Post by Ruepler » Mon, Mar 18, 2024, 7:29 AM UTC

junon wrote: post #34

oefrha wrote: post #26

Earlier quoted context omitted.

Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1] > In general, GitHub Apps are preferred over OAuth apps. [1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

Even with apps, you still do not have the fine grained permissions you'd think you'd get. Have you tried?

You can for sure. I am using it with Cloudflare pages for example. It's a matter of a click.

Re: Mintlify GitHub read/write token leak

#44

Post by Ruepler » Mon, Mar 18, 2024, 7:37 AM UTC

brycelarkin wrote: post #8

I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…

Exactly. You'd need to implement standard authentication mechanisms, preventing these vectors of attack from existing in the first place.

They are "in the process" and "looking" to do that. As of now if I am not mistaken the main issue still persists and any other new security vulnerability will possibly give full access to tokens again.

Correct me if I am wrong please but I don't see anything in the comment or Blog post saying otherwise.

> and are also in the process of completely deprecating the admin tokens for a more secure internal authentication procedure. Not to mention, we're also looking to fully deprecate the need of the GitHub OAuth tokens entirely in the coming weeks.

https://www.reddit.com/r/cscareerquestions/comments/1bh22bq/...

Re: Mintlify GitHub read/write token leak

#45

Post by junon » Mon, Mar 18, 2024, 9:03 AM UTC

oefrha wrote: post #40

junon wrote: post #34

Earlier quoted context omitted.

Even with apps, you still do not have the fine grained permissions you'd think you'd get. Have you tried?

With apps, you can certainly grant access to individual repos instead of all repos. Yes I’ve tried. Here’s how this thread went: brycelarkin: Mintlify’s GitHub app asked for permissions to access all my repos. You: Developers don’t have the option to not access all repos. Me: False. GitHub apps do have fine grained permissions, as in they don’t have to have to access all repos. You: Even with apps you don’t have fine…

Org access. You seem to be very hostile in your tone, by the way.