Re:GitHub waited 3 months to notify about potential compromise
by zwass on Thursday June 16, 2022 @05:41PM
(#31771332)
contents:read to contents:write is a big deal! Just to pick out a random widely used project, nodejs [1] has a number of unsigned commits to the main branch. Their commits could have been tampered with during this timeframe.
What about release artifacts?
Re:GitHub waited 3 months to notify about potential compromise
by njibhu on Thursday June 16, 2022 @05:58PM
(#31771497)
I guess I can see it, but branch protection rules and pull requests reviews would also prevent that to happen in my opinion
(also ability to do it with content:write is just speculation from my side, they don't make it clear if it is possible, that would need to be confirmed by github)
- a github app which had read permission on issues could elevate its permission to write
- a github app which had read permissions to discussions could elevate its permissions to write.
So far if the org/user would have been compromise they would have seen with issues or conversations containing content from the app.
Since these are only examples, I can imagine the case with major impact would be a contents:read elevate to content write. But again with commit signing, this would also be caught by the user. What did I miss where the impact would have not been visible to the end user/org ?