Compsci student walks off with $50,000 after bug bounty report blows gaping hole in Shopify software repos
(2021/07/27)
- Reference: 1627388052
- News link: https://www.theregister.co.uk/2021/07/27/shopify_bug_bounty_payout/
- Source link:
Shopify has forked out $50,000 (£36,150) in a bug bounty payment to computer science student Augusto Zanellato following the discovery of a publicly available access token which gave world+dog read-and-write access to the company's source code repositories.
Zanellato uncovered the vulnerability while investigating a third-party Electron-based macOS application created by a Shopify developer. "I can't share the name," Zanellato told The Register , "but I can say it's a desktop client for a popular video conferencing platform which doesn't provide an official one."
The issue: the inclusion of an environment file in the compiled application, which when extracted revealed the developer's access token for their GitHub account – an account which had access not only to the application's own repository but to Shopify's repositories too.
[1]
"After finding the GitHub token inside the application I tried to use it against the GitHub API to see what token it was, whom it belongs to, what privileges it had etc.," Zanellato told us. "I found out that the user in question was a member of the Shopify organisation and that he had push and pull access to all the private Shopify repositories."
[2]
[3]
The token gave Zanellato, and by extension anyone else who investigated the inner workings of the publicly-available app, complete access to Shopify's GitHub repositories. With it, Zanellato was able to confirm the ability to push modified source code – which if not spotted in time would be included in Shopify's software builds, offering a route to introduce a backdoor into sites using the software.
Thankfully, the Canadian e-commerce giant took the issue as seriously as it should. Following [4]private disclosure , now released publicly, via the HackerOne bug bounty platform, the company revoked the access token within 24 hours and granted the vulnerability a CVSS severity score of 10 – the highest possible.
[5]
"We addressed this issue immediately after receiving this report by revoking the GitHub Personal Access Token," Jack McCracken, senior application security engineer at Shopify, wrote in a follow-up to the report. "However, we wanted to wait to resolve this issue until we felt we had implemented a long-term mitigation that reduced the likelihood that it would reoccur."
In its own summary, Shopify notes that an audit of access logs confirmed "no unauthorised activity" relating to the access token had occurred. The company has not, however, detailed exactly what steps it has taken to prevent similar security issues in the future.
"It wasn't really Shopify's fault here," Zanellato told us, "because for what I know GitHub doesn't (at least yet) support generating an access token that grants access to personal repositories but not to organisation-owned ones. There's something similar to that because GitHub applications can be granted access only to user repositories without granting organisation access, but no similar things for tokens."
[6]
A two-factor authentication dongle wouldn't have helped either, Zanellato explained: "I strongly support using physical tokens for 2FA but in this case it would have been worthless because access tokens are meant to be used by computers and not by humans. As such they ignore if 2FA is enabled or not in the owner account."
[7]Microsoft, Google, Citizen Lab blow lid off zero-day bug-exploiting spyware sold to governments
[8]So nice of China to put all of its network zero-day vulns in one giant database no one will think to break into
[9]With a straight face, Putin agrees to do something about ransomware coming out of Russia, apparently
[10]Belgian boffins dump Starlink dish terminal's firmware, gain root access and a few ideas
A severe vulnerability deserves a hefty payout, and Shopify surprised Zanellato with its generosity on that front: the company paid out an impressive $50,000 (£36,150) for his responsible disclosure, made six months ago – the maximum it offers in its bug bounty programme, which averages $500-750 (£362-542) per bounty. Since launch, the company has paid out $1.6m (£1.16m) through the programme across 1,221 resolved reports.
The bumper bounty was Zanellato's first. "It might surprise you, but in fact I never started hunting for bugs," he said. "I have a technical background as a programmer (mainly game developing and backend, but I also have some frontend experience) with a focus on writing secure stuff instead of things that just work but with security holes as big as the Kimberley Mine."
Shopify was founded in 2006 by Tobias Lütke and Scott Lake following the pair's failure to find a suitable off-the-shelf e-commerce platform for a planned snowboarding store, Snowdevil. Today the Shopify platform is used by more than 1.7 million merchants globally – all of whom could have been impacted by the leaked token, had it been abused.
It may not be the only company affected, however. "I haven't found a lot of reports investigating Electron applications so I'm not sure about how common this specific vulnerability is," Zanellato told us, "but I think it could be an attack surface that's not well explored.
"I don't think companies can do much to protect themselves against this kind of vulnerability except forcing employees to have a work account separated from the personal account, but that would be a hassle in my opinion. The best solution would be that GitHub adds some way of limiting access tokens scope to a subset of a user's repositories or organisations."
Shopify did not respond to a request for additional comment, in particular on why developers were allowed to use the same GitHub accounts for personal projects as unlocks the company's repositories and the steps it has taken to prevent future issues of the same kind, in time for publication.
Neither did GitHub, [11]acquired by Microsoft in 2018 for $7.5bn, respond to queries regarding Zanellato's comments for how it could potentially address the issue in the future. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://hackerone.com/reports/1087489
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/07/16/microsoft_candiru_malware/
[8] https://www.theregister.com/2021/07/15/china_vulnerability_law/
[9] https://www.theregister.com/2021/07/12/in_brief_security/
[10] https://www.theregister.com/2021/07/08/belgian_boffins_dump_starlink_dish/
[11] https://www.theregister.com/2018/06/04/microsoft_buys_github/
[12] https://whitepapers.theregister.com/
Zanellato uncovered the vulnerability while investigating a third-party Electron-based macOS application created by a Shopify developer. "I can't share the name," Zanellato told The Register , "but I can say it's a desktop client for a popular video conferencing platform which doesn't provide an official one."
The issue: the inclusion of an environment file in the compiled application, which when extracted revealed the developer's access token for their GitHub account – an account which had access not only to the application's own repository but to Shopify's repositories too.
[1]
"After finding the GitHub token inside the application I tried to use it against the GitHub API to see what token it was, whom it belongs to, what privileges it had etc.," Zanellato told us. "I found out that the user in question was a member of the Shopify organisation and that he had push and pull access to all the private Shopify repositories."
[2]
[3]
The token gave Zanellato, and by extension anyone else who investigated the inner workings of the publicly-available app, complete access to Shopify's GitHub repositories. With it, Zanellato was able to confirm the ability to push modified source code – which if not spotted in time would be included in Shopify's software builds, offering a route to introduce a backdoor into sites using the software.
Thankfully, the Canadian e-commerce giant took the issue as seriously as it should. Following [4]private disclosure , now released publicly, via the HackerOne bug bounty platform, the company revoked the access token within 24 hours and granted the vulnerability a CVSS severity score of 10 – the highest possible.
[5]
"We addressed this issue immediately after receiving this report by revoking the GitHub Personal Access Token," Jack McCracken, senior application security engineer at Shopify, wrote in a follow-up to the report. "However, we wanted to wait to resolve this issue until we felt we had implemented a long-term mitigation that reduced the likelihood that it would reoccur."
In its own summary, Shopify notes that an audit of access logs confirmed "no unauthorised activity" relating to the access token had occurred. The company has not, however, detailed exactly what steps it has taken to prevent similar security issues in the future.
"It wasn't really Shopify's fault here," Zanellato told us, "because for what I know GitHub doesn't (at least yet) support generating an access token that grants access to personal repositories but not to organisation-owned ones. There's something similar to that because GitHub applications can be granted access only to user repositories without granting organisation access, but no similar things for tokens."
[6]
A two-factor authentication dongle wouldn't have helped either, Zanellato explained: "I strongly support using physical tokens for 2FA but in this case it would have been worthless because access tokens are meant to be used by computers and not by humans. As such they ignore if 2FA is enabled or not in the owner account."
[7]Microsoft, Google, Citizen Lab blow lid off zero-day bug-exploiting spyware sold to governments
[8]So nice of China to put all of its network zero-day vulns in one giant database no one will think to break into
[9]With a straight face, Putin agrees to do something about ransomware coming out of Russia, apparently
[10]Belgian boffins dump Starlink dish terminal's firmware, gain root access and a few ideas
A severe vulnerability deserves a hefty payout, and Shopify surprised Zanellato with its generosity on that front: the company paid out an impressive $50,000 (£36,150) for his responsible disclosure, made six months ago – the maximum it offers in its bug bounty programme, which averages $500-750 (£362-542) per bounty. Since launch, the company has paid out $1.6m (£1.16m) through the programme across 1,221 resolved reports.
The bumper bounty was Zanellato's first. "It might surprise you, but in fact I never started hunting for bugs," he said. "I have a technical background as a programmer (mainly game developing and backend, but I also have some frontend experience) with a focus on writing secure stuff instead of things that just work but with security holes as big as the Kimberley Mine."
Shopify was founded in 2006 by Tobias Lütke and Scott Lake following the pair's failure to find a suitable off-the-shelf e-commerce platform for a planned snowboarding store, Snowdevil. Today the Shopify platform is used by more than 1.7 million merchants globally – all of whom could have been impacted by the leaked token, had it been abused.
It may not be the only company affected, however. "I haven't found a lot of reports investigating Electron applications so I'm not sure about how common this specific vulnerability is," Zanellato told us, "but I think it could be an attack surface that's not well explored.
"I don't think companies can do much to protect themselves against this kind of vulnerability except forcing employees to have a work account separated from the personal account, but that would be a hassle in my opinion. The best solution would be that GitHub adds some way of limiting access tokens scope to a subset of a user's repositories or organisations."
Shopify did not respond to a request for additional comment, in particular on why developers were allowed to use the same GitHub accounts for personal projects as unlocks the company's repositories and the steps it has taken to prevent future issues of the same kind, in time for publication.
Neither did GitHub, [11]acquired by Microsoft in 2018 for $7.5bn, respond to queries regarding Zanellato's comments for how it could potentially address the issue in the future. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://hackerone.com/reports/1087489
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQAtujmrCAp64oWaTBYCXAAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/07/16/microsoft_candiru_malware/
[8] https://www.theregister.com/2021/07/15/china_vulnerability_law/
[9] https://www.theregister.com/2021/07/12/in_brief_security/
[10] https://www.theregister.com/2021/07/08/belgian_boffins_dump_starlink_dish/
[11] https://www.theregister.com/2018/06/04/microsoft_buys_github/
[12] https://whitepapers.theregister.com/
Really a large flaw in github
flibble
I think anyone that has authorised external services to access GitHub one way or another has run into this issue if they're paying attention. I've had to create secondary GitHub accounts (with more limit permissions) multiple times to be able to generate tokens with sufficiently limited privileges (or at least not massively over reaching permissions), and having that many extra GitHub accounts hanging around creates other potential problems.
It's something GitHub really need to address. There are a lot of tokens out there, it's pure luck that there haven't been more incidents.
DevOpsTimothyC
It's something GitHub really need to address. There are a lot of tokens out there, it's pure luck that there haven't been more incidents.
It's really easy to address in GH. Require your dev's to access GH via corporate SSO and not via their personal logins.
Granted it will annoy alot of developers having to auth to github via their org rather than with personal credentials, but it's not GH's fault that many org's allow access via accounts they do not control and have not locked down
"he had push and pull access to all the private Shopify repositories"
Pascal Monett
And he inculded that access in the code he made publicly available.
He should be banned from posting to GitHub permanently.
Generosity
elsergiovolador
Was it really generous though given what could have happened if the token was in the wrong hands?
They had $1,541.5 million of profit in 2020. The pay out equates to about 0.003% of that amount.
Surely they could add one or two zeroes.
Also why would you include a token in your app at all?
Re: Generosity
Pseudononymous Coward
How much does Fancy Bear and similar organisations pay for such things?
Separate accounts is the only way
Microsoft, Apple, Google, Amazon and Facebook don't want people to do that and in some cases ban it, but it is the only way to have decent security.
A work account and a personal account, and ne'er the twain shall meet.