GitHub Repojacking Bug Could’ve Allowed Attackers to Takeover Other Users’ Repositories

Cloud-primarily based repository hosting support GitHub has resolved a superior-severity security flaw that could have been exploited to produce malicious repositories and mount provide chain attacks.

The RepoJacking method, disclosed by Checkmarx, entails a bypass of a safety system known as common repository namespace retirement, which aims to stop developers from pulling unsafe repositories with the exact same title.

The issue was dealt with by the Microsoft-owned subsidiary on September 19, 2022 adhering to accountable disclosure.

RepoJacking happens when a creator of a repository opts to modify the username, most likely enabling a menace actor to declare the aged username and publish a rogue repository with the same identify in an attempt to trick buyers into downloading them.

While Microsoft’s countermeasure “retire[s] the namespace of any open up source challenge that had more than 100 clones in the 7 days main up to the owner’s account getting renamed or deleted,” Checkmarx discovered that this can be circumvented via the “repository transfer” aspect.

The way this functions is as follows –

• A danger actor produces a repository with the same identify as the retired repository (say, “repo”) owned by a consumer named “target” but underneath a different username (say, “helper”)
• “helper” transfers possession of “repo” to a next account with username “attacker”
• “attacker” renames the account’s username to “sufferer”
• The namespace “victim/repo” is now underneath the adversary’s command

In other terms, the attack hinges on the quirk that GitHub only considers as retired the namespace, i.e., the blend of username and repository name, allowing a terrible actor to reuse the repository identify in conjunction with an arbitrary username.

A successful exploitation could have successfully permitted attackers to force poisoned repositories, placing renamed usernames at risk of being a victim of source chain assaults.

“If not explicitly tended, all renamed usernames on GitHub had been susceptible to this flaw, such as more than 10,000 packages on the Go, Swift, and Packagist bundle supervisors,” Checkmarx researcher Aviad Gershon claimed.

Found this article attention-grabbing? Observe THN on Fb, Twitter  and LinkedIn to study additional exclusive written content we put up.

Some parts of this article are sourced from:
thehackernews.com