Pierluigi Paganini
June 23, 2023
A study conducted by Aqua researchers revealed that millions of GitHub repositories are potentially vulnerable to RepoJacking.
In the RepoJacking attack, attackers claim the old username of a repository after the legitimate creator changed the username, then publish a rogue repository with the same name to trick users into downloading its content.
The “popular repository namespace retirement” mechanism was introduced by Github to prevent RepoJacking. According to the security measure, any repository with more than 100 clones at the time its user account is renamed is considered “retired” and cannot be used by others.
The combination of the username and the repository name is considered “retired.”
The successful exploitation of the flaw could have allowed attackers to push repositories containing malicious code and launch supply chain attacks using renamed usernames.
The exploitation of the issue may lead to code execution on organizations’ environments. The researchers state that also repositories of big enterprises such as Google and Lyft are at risk. The good news is that all the organizations that were notified of this vulnerability promptly addressed it.
Websites such as the GHTorrent project records any public event (commit, PR, etc.) associated with Github repositories and saves it in a publicly available database. Threat actors can query this database to uncover the historical names of various organizations and determine if they are potentially exposed to RepoJacking.
The experts used a sample from the database related to June 2019 and compiled a list of 125 million unique repositories’ names. Then, the researchers sampled 1% (1.25 million repositories’ names) and analyzed each one to see if it was vulnerable to RepoJacking. The result was disconcerting, the researchers found 36,983 repositories vulnerable to RepoJacking, with an approximate success rate of 2.95%. Extrapolating the result, the researchers speculate that in the entire GitHub repositories’ base (over 300 million repositories according to GitHub publications), there are potentially millions of vulnerable repositories!
One of the vulnerable repositories is google/mathsteps, which was owned by the company Socratic (socraticorg/mathsteps), which was acquired by Google in 2018.
“As you can see the instructions guide to clone the project from the Socraticorg (‘https://github.com/socraticorg/mathsteps’) organization rather than the Google (‘https://github.com/google/mathsteps’) organization. A quick Google search reveals that Socratic Org is a subsidiary of Google. (They were founded in 2013, launched their app in 2016 under this name, and acquired by Google on 2018)” continues the report. “When you access https://github.com/socraticorg/mathsteps, you are being redirected to https://github.com/google/mathsteps so eventually the user will fetch Google’s repository. However, because the socraticorg organization was available, an attacker could open the socraticorg/mathsteps repository and users following Google’s instructions will clone the attacker’s repository instead. And because of the npm install this will lead to arbitrary code execution on the users.”
The researchers identified two exploitation scenarios:
Researchers recommend that users periodically inspect their code for links that may fetch resources from external GitHub repositories. Organizations that have changed their name should ensure that they still own the previous name as well, even as a placeholder, to prevent attackers from creating it.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, RepoJacking)
