Governance
GitHub Vulnerability Exposes 4,000+ to RepoJacking Attack
Image from PixaBay GitHub, the widely used code hosting platform, revealed that more than 4,000 code packages are vulnerable to RepoJacking attacks. This flaw, uncovered by Checkmarx researchers, has raised concerns within the open-source community and prompted swift action from GitHub. The RepoJack…
Headline
Image from PixaBay GitHub, the widely used code hosting platform, revealed that more than 4,000 code packages are vulnerable to RepoJacking attacks. This flaw, uncovered by Checkmarx researchers, has raised concerns within the open-source community and prompted swift action from…
Context
GitHub, the widely used code hosting platform, revealed that more than 4,000 code packages are vulnerable to RepoJacking attacks. This flaw, uncovered by Checkmarx researchers, has raised concerns within the open-source community and prompted swift action from GitHub. The RepoJacking Attack Explained
Evidence
Pending intelligence enrichment.
Analysis
RepoJacking, short for repository hijacking, is a technique used by threat actors to take control of a repository. This attack method involves exploiting a race condition between GitHub’s repository creation and username renaming processes. Essentially, attackers claim the old username of a repository after the legitimate creator changes the username. They then publish a rogue repository with the same name, deceiving users into downloading malicious content. The consequences of this vulnerability are far-reaching. It affects over 4,000 code packages across programming languages like Go, PHP, and Swift, as well as GitHub actions. Many of these packages have gained significant popularity, with over 1,000 stars. We are yet to uncover the potential impact on millions of users and various applications. Checkmarx responsibly disclosed this vulnerability to GitHub on March 1, 2023, which prompted action from the platform. GitHub introduced the “popular repository namespace retirement” mechanism to prevent RepoJacking. With this security measure, repositories with more than 100 clones at the time of a username change are considered “retired” and cannot be used by others. The combination of the username and the repository name is also considered “retired.” However, the security measure turned out to be easily circumvented. Checkmarx identified over 4,000 packages in package managers that used renamed usernames, putting them at risk of hijacking.
Key Points
- The victim owns the namespace “victim_user/repo.”
- The victim renames “victim_user” to “renamed_user.”
- The “victim_user/repo” repository becomes retired.
- An attacker with the username “attacker_user” simultaneously creates a repository called “repo” and renames the username “attacker_user” to “victim_user.”
Actions
Pending intelligence enrichment.
