BuildBuddy (Victim): news timeline & CVEs

GitHub App keys can still enable takeovers long after they are forgotten

GitGuardian found 474 still-valid leaked GitHub App keys that can enable repository access and organization takeovers.

GitGuardian reported that GitHub App private keys do not expire and stay usable until manually revoked. Of 4,802 publicly exposed keys collected since 2019, 474 were still valid; 72 percent could read private repository content and 207 could write to it. Forty apps could administer self-hosted runners, 98 could control workflows, and 44 had organization-administration rights. A key for Access Tokens for GitHub Actions, exposed in January 2024, potentially affected about 300 installing organizations, including Civica and Sierra Nevada Corp; BuildBuddy, Crusher.dev, and a CDC-associated app were also named.

CSO OnlineSep 23, 15:12 UTC · 3d agoResearch 2 sources

Hundreds of Leaked GitHub App Keys Still Authenticate

GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.

GitGuardian tested 4,802 exposed RSA private keys paired with GitHub App IDs and found 474, about 10 percent, still authenticated as 440 distinct Apps. GitHub App private keys do not expire until they are manually deleted, and a holder can mint access tokens indistinguishable from the App. About 72 percent could read private repositories, 207 could write, 44 had organization administration rights, and one Actions token App covered roughly 300 organizations. A CDC App key leaked in a CDCGov repository was revoked on September 18 after disclosure; BuildBuddy and the Actions maintainer also rotated keys and reported no malicious use.

Infosecurity Magazineupdated Sep 23, 15:12 UTC · 3d agofirst Sep 23, 15:00 UTC · 3d agoData breach 2 sources

BuildBuddy

Timeline2 articles

Appears with

GitHub App keys can still enable takeovers long after they are forgotten

Hundreds of Leaked GitHub App Keys Still Authenticate