HexBrain

Ian Dunn · Report #461345

Security issue: Github repo's wiki publicly editable

Informativestatus
3upvotes
12 Dec 2018disclosed

How it was found

Hello Team,

Github repo's wiki page is publicly editable. This enables an attacker to edit the wiki pages of the affected repo's. Adding content that may link to malicious code libraries that would be installed and used by developers or information that may mislead users.

POC Links: https://github.com/iandunn/MU-Migration/wiki https://github.com/iandunn/wp-hammer/wiki https://github.com/iandunn/gutenberg/wiki https://github.com/iandunn/dotfiles/wiki

Impact

This enables an attacker to edit the wiki pages of the affected repo's. Adding content that may link to malicious code libraries that would be installed and used by developers or information that may mislead users.

Thank you.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original