Executive brief
grunt-gh-pages is a Node.js build tool that automates deployment to GitHub Pages. The vulnerability allows GitHub authentication tokens to be written in plain text to log files when credentials are injected into deployment URLs, potentially exposing them in publicly accessible build logs or CI/CD environments.
Technical details
grunt-gh-pages versions before 0.10.0 fail to sanitize GitHub authentication tokens that are embedded in repository URLs during deployment. When using the authentication pattern where a token is injected directly into the URL's auth portion (e.g., https://token@github.com/user/repo), the library writes the complete URL, including the unencrypted token, to log files. This is a credential exposure vulnerability (CWE-391: Unchecked Error Condition). The attack vector requires the attacker to gain access to log files—either through a public CI/CD system like Travis CI or by accessing a compromised build server. The fix (version 0.10.0+) removes auth credentials from logged output.
Affected products
- npm grunt-gh-pages before 0.10.0
Timeline
- 2019-02-18: disclosed: Advisory published
- 2015-02-14: patched: Fix merged in version 0.10.0