Over the past few days, a discussion has been happening on HackerNews around counter-intuitive GitHub features that allow anyone to access commits you thought had been deleted. As reminded on this page, these behaviors are well-known and were reported to GitHub back in 2018.
For storage efficiency, GitHub places repositories and forks in a network where all commits are saved together, and each fork keeps references separately. When a commit is deleted from a repository, it stays visible within its network of forks.
The yellow commit remains visible by the network even after the repository is deleted.
As a developer, you may have already noticed that when you do a force-push, the corresponding Pull Request still mentions commits that were deleted.
These dangling commits are called GitHub Cached Views and can be accessed using a commit SHA-1 such as https://github.com/GitGuardian/ggshield/commit/1e820de77f3ee74a22eb834b6b6efd0c6b8ce4f0, where the following sentence warns you about the issue:
GitHub has documented several ways of accessing a commit after it has have been deleted:
- in any fork
- using its hash in a cached view
- via a Pull Request that mentions it
When it comes to secrets, these GitHub Cached Views are problematic because they remain publicly available while you believe they were not. Attackers don't even need to know the full hash of the commit. They can access GitHub Cached Views using the first four characters of the hash which makes it possible to enumerate all of the 65536 combinations, in about half a day per repository. Again, this emphasizes that once a secret has been leaked, it must be revoked.
GitHub Cache Views are therefore dangerous blind spots for organizations as they expose commits supposedly deleted.
Regarding GitHub Cached Views, hard-coded secrets are more of a threat than ever. They should be discovered timely, whether in public or private repositories. If you are concerned about private repositories that have recently been made public, contact us. We will scan your repositories for secrets and help you remediate efficiently.
GitGuardian Public Monitoring has your back, and will detect secrets leaked in public commits. We love and support open-source developers and our Good Samaritan Program will send you an email if you ever leak a secret on public GitHub.
Interested in checking your public secrets exposure?
*** This is a Security Bloggers Network syndicated blog from GitGuardian Blog - Code Security for the DevOps generation authored by Guillaume Valadon. Read the original post at: https://blog.gitguardian.com/demystifying-github-cached-views-the-hidden-danger/