Use Github pack with Coda employee github account (search code of Coda's private repositories)

How it was found

Summary:

When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula (Github..CodeSearch), the version of the Github pack (3.4.1), the id of the Github connection (generated by Coda when connecting your account), the id of the document to which the Github account is linked, and the parameters for the formula.

The issue is that you can take the document id and connection id of any public document and use the formula as you please. Also, it's not required to be authenticated to make a request to the endpoint https://coda.io/coda.CalcService/InvokeFormula. It may be working as designed, so that's why I used a document created by a Coda employee for the proof of concept in case that is considered a N/A report :D

Steps To Reproduce:

Pass all requests through Burp or similar proxy to make the reproduction easier.

1. Make sure you are signed in https://coda.io
2. Go to https://coda.io/t/Git-Cherry-Pick-From-Branch_tTZJuuyHgqa/preview?useBack
3. If you look at the requests in Burp, you will see a request to https://coda.io/embed/igvicDMruo?viewMode=gallery&disconnected=true that is loaded in an <iframe> (it is the document you see when you load the template). "igvicDMruo" is the document id.
4. Using the document id from the last step, go to https://coda.io/internalAppApi/documents/igvicDMruo/externalConnections
5. The value that matters from the response is the id of the object with name "albertc44". The connection id is 7b167155-731e-4913-9091-729c5bd77ee0
6. Go to https://coda.io/newdoc/POC
7. Click "Create doc"
8. Click the "Open Packs" button at the top right. It is the puzzle piece icon between the robot and the arrows
9. Click "+ Add a new Pack"
10. Click the "Github" card/box
11. Click the orange "Sign in to install" button
12. Click "Authorize codaprojectapp"
13. Click "You and anyone this doc is shared with"
14. Click "Nobody"
15. Click the orange "+" button at the top of the document
16. Go to "Formula", then "Github", and then click "CodeSearch"
17. In the dialog opened press the key "Tab", enter comma ,, enter "secret", enter ,, enter organization: "kr-project" and finally press the key "Enter"
18. In Burp Proxy or similar, find the last request to /coda.CalcService/InvokeFormula and send it to the Repeater or similar to modify
19. Remove the Cookie header
20. The value between $ and 2$ is the connection id. Replace this value with the 7b167155-731e-4913-9091-729c5bd77ee0 you got before (don't touch the 2 before the $ 😅 )
21. The first ten characters of the last line are the document id. Replace it with the document id you got in the first steps (igvicDMruo)
22. Send the request
23. The most interesting things in the response are the values of Fragment

Supporting Material/References:

None

Impact

It's possible to search the code of all the private repositories to which https://github.com/albertc44 has access. Including the ones of the kr-project organization, that is where the Coda repositories are.