GitHub Gist: Vulnerability patched in code-sharing web service

guest · Oct 22, 2020

GitHub Gist: Account takeover vulnerability patched in code-sharing web service
October 22, 2020
https://portswigger.net/daily-swig/...erability-patched-in-code-sharing-web-service

The GitHub security team has patched an account takeover vulnerability in the GitHub Gist code-sharing service that earned its finder a $10,000 reward.
GitHub Gist enables developers to instantly share snippets of code through either public or private repositories.

On October 19, developer and bug bounty hunter William “vakzz” Bowling released a GitHub security advisory – one of three – that disclosed a severe bug exposing individual ‘gists’ due to open redirect errors.

“It would give an attacker the ability to log into gist.github.com as the victim with full access to their public and secret gists. So, it would depend on what the victim had stored, but generally secret gists are secret for a reason and you don’t want unauthorized people seeing them.”
The security team triaged the submission and applied a hotfix by July 29, patching the issue on the github.com domain. A $10,000 bug bounty was awarded on October 15.
Click to expand...

Log in or Sign up

GitHub Gist: Vulnerability patched in code-sharing web service

guest Guest

Log in or Sign up

GitHub Gist: Vulnerability patched in code-sharing web service

guest Guest

Useful Searches