"High-Severity Vulnerability in GitHub Was Susceptible to Repo Jacking"

Researchers discovered a "high-severity" vulnerability in GitHub, which could have allowed an attacker to take control of a GitHub repository and potentially infect all applications and other code that relied on it with malicious code. According to researchers from the Checkmarx Supply Chain Security team, an attacker can take control of a GitHub repository using a technique known as Repo Jacking by exploiting a logical "hidden" flaw in the architecture that makes renamed users vulnerable to such an attack. The searchers say this flaw affected all renamed usernames on GitHub, including over 10,000 packages on the Go, Swift, and Packagist package managers. Thousands of packages can be hijacked instantly and begin serving malicious code to millions of users and numerous applications, according to the researchers. GitHub fixed this vulnerability in response to Checkmarx's report, and it is no longer exploitable. Aviad Gershon, security researcher and team leader at Checkmarx, explained that his team witnessed attackers using the Repo Jacking technique earlier this year, demonstrating how malicious actors will constantly evolve their methodologies to find the simplest ways to leverage trusted open-source packages for maximum impact. Thousands of projects and millions of end users rely on open-source libraries and code repositories, making them an appealing target for threat actors. If they can gain control of a GitHub repository and insert malicious code into a trusted and widely used project, they can easily infect tens of thousands to millions of hosts. This article continues to discuss the discovery and potential impact of the high-severity GitHub vulnerability.

SC Magazine reports "High-Severity Vulnerability in GitHub Was Susceptible to Repo Jacking"