Executive brief
The octokit/webhooks library is used by GitHub Apps and automation frameworks to process GitHub webhook events. A flaw in error handling can cause an uncaught exception that crashes the Node.js process hosting the application, resulting in service downtime without requiring authentication or user interaction.
Technical details
The vulnerability stems from improper error handling in the verify method of @octokit/webhooks, where an error object can be undefined in certain conditions, causing an uncaught exception when the code attempts to access properties on the undefined value. This leads to a process crash (denial of service). The vulnerability is triggered via network requests to the webhook endpoint and requires no authentication or privileges. An unauthenticated attacker can send specially crafted webhook requests to crash the application. Patches are available in v9.26.3, v10.9.2, v11.1.2, and v12.0.4 of @octokit/webhooks.
Affected products
- Octokit webhooks before 9.26.3, 10.0.0 before 10.9.2, 11.0.0 before 11.1.2, 12.0.0 before 12.0.4
- Octokit app 14.0.1
- Octokit octokit before 3.1.2
- Probot probot before 12.3.3
Timeline
- 2023-12-16: disclosed: GHSA-pwfr-8pq7-x9qv published
- 2023-12-15: other: CVE-2023-50728 assigned