Executive brief
aegir is a build and release tool for JavaScript projects. When developers use the aegir-release command to publish a new version, the tool accidentally bundles and publishes their GitHub authentication token to the npm registry, exposing it to anyone with access to the published package. An attacker could retrieve the leaked token and gain unauthorized access to the developer's GitHub account and repositories.
Technical details
The vulnerability is an information exposure (CWE-200) that occurs in aegir versions 12.0.0 through 12.0.7. When the aegir-release command is executed, the tool includes the current user's GitHub token in the files it bundles and publishes to npm. No authentication is required to retrieve published npm packages, making the leaked token accessible to any attacker. An attacker can use the exposed token to authenticate as the developer on GitHub, potentially gaining access to private repositories, modifying code, creating malicious releases, or exfiltrating sensitive data. The vulnerability was fixed in version 12.0.8. Users who were affected should immediately invalidate their GitHub tokens.
Affected products
- aegir aegir 12.0.0 to 12.0.7
Timeline
- 2018-07-24: disclosed