GitHub App keys can still enable takeovers long after they are forgotten
GitGuardian found 474 still-valid leaked GitHub App keys that can enable repository access and organization takeovers.
GitGuardian reported that GitHub App private keys do not expire and stay usable until manually revoked. Of 4,802 publicly exposed keys collected since 2019, 474 were still valid; 72 percent could read private repository content and 207 could write to it. Forty apps could administer self-hosted runners, 98 could control workflows, and 44 had organization-administration rights. A key for Access Tokens for GitHub Actions, exposed in January 2024, potentially affected about 300 installing organizations, including Civica and Sierra Nevada Corp; BuildBuddy, Crusher.dev, and a CDC-associated app were also named.
- 474 of 4,802 exposed GitHub App keys remained valid.
- 207 valid keys could write to private repositories.
- 44 apps had organization-administration privileges enabling takeover.
- A 2024 Actions app key leak potentially affected about 300 organizations.
- Private keys never expire; only manual revocation stops them.
- Vendors
- GitHubGitGuardian
- Products
- GitHub AppsGitHub Actions
- Victims
- CivicaSierra Nevada CorporationCenters for Disease Control and PreventionBuildBuddyCrusher.dev
- Organizations
- GitGuardianColorTokensCivicaSierra Nevada CorporationBuildBuddyCrusher.devCenters for Disease Control and Prevention
- Countries
- United States
From the original article
4 min read at csoonline.com
GitHub allows organizations to install GitHub Apps that automate and extend certain functionality on the platform and have access to selected repositories and permissions. But the private keys these applications use to authenticate themselves can remain valid for years unless manually revoked.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.