Exposed GitHub App Keys Risk Organizational Security Long After Use

GitHub Apps are essential tools for organizations, streamlining various processes and automating functionalities on the platform. They require private keys for authentication, but the surprising reality is that these keys can remain active indefinitely unless revoked by the users. This presents serious security vulnerabilities if compromised.

According to GitGuardian, a security research firm, they've identified 474 valid GitHub App private keys out of 4,802 that have been publicly exposed since 2019. Their findings suggest that the risk is substantial, as 72% of these compromised applications had the ability to read from private repositories, while 207 could write to them. GitGuardian's researcher, Gaetan Ferry, emphasized that a single leaked key could lead to a complete organizational takeover.

One notable example involved the "Access Tokens for GitHub Actions," an app crucial for managing access in GitHub workflows. This specific key was unintentionally exposed last January when it was mistakenly committed to a public repository, potentially impacting around 300 organizations, including Civica and Sierra Nevada Corp.

Other applications at risk included those tied to BuildBuddy, Crusher.dev, and even a private app linked to the US Centers for Disease Control and Prevention, showcasing a wide range of potential vulnerabilities across various sectors.

Vulnerabilities with Leaked Keys

The nature of GitHub Apps is that organizations can determine which repositories an app accesses and what permissions it has. GitGuardian’s research revealed that 40 leaked Apps had privileges to manage self-hosted runners, 98 to control workflows, and 44 possessed organization-admin rights. Such permissions could allow an attacker to not only access sensitive data but to escalate their privileges and shut out legitimate administrators.

Interestingly, some of the leaked Apps had very few installations, with 59% having only one. Ferry remarked on the prevalence of these internal-use Apps, suggesting they can be easily forgotten—an oversight that can leave the keys functioning for years post the app's actual use.

Furthermore, GitGuardian's findings included cases where leaked private keys surfaced in unrelated repositories, complicating the association between the key and the original owning GitHub App. Ferry warned about the far-reaching consequences, stating that the impact doesn’t just stop with the organization that owns the App but extends to every entity that installed it, creating a ripple effect through the supply chain.

Addressing the Key Management Challenge

Despite GitHub's warning in their documentation about the necessity of revoking private keys, companies often neglect this responsibility. There's a prevailing misconception regarding how these keys operate. When an organization installs an App, a private key is generated to sign a short-lived JSON Web Token (JWT), allowing GitHub to issue temporary installation access tokens that carry specific permissions.

The tokens that are created using the JWT have restricted validity windows—usually they expire within minutes or a few hours. This could create an illusion of security, where organizations think losing a key poses minimal risk. However, the reality is different: those holding the private key can continuously generate new JWTs, maintaining access for as long as the private key is active.

Sarkar from ColorTokens remarked that this design choice could be intentional, as keeping private keys valid ensures operational continuity despite the security risks involved. He pointed out that the burden of maintaining key rotation relies solely on the App owners.

To mitigate risks, GitGuardian advocates for routine rotation or revocation of private keys, given that they could outlive their original use as well as the individuals who created them. Errors from the past, like a key committed to a repository in 2020, may still provide access today, often without the organization’s awareness.

However, Sarkar notes that proactive revocation of keys is rare, typically only occurring reactively due to security incidents or audits. It's crucial for organizations to plan for and implement proper key management strategies to safeguard their infrastructure against potential breaches.

This article first appeared on InfoWorld.