1738320 - Github Account Takeover of "mozilla-release-automation-bot" from "github.com/mozilla-mobile/fenix"

Status: RESOLVED FIXED

(Firefox for Android :: General, defect)

Description

[Arshad Kazmi [:arshadkazmi42]]

Summary

One of the repository of mozilla https://github.com/mozilla-mobile/fenix have a Sprint template. In that template one part is to give access to mozilla release bot github acccount. That github account was not registered on github.com
So I was able to takeover the account and host PoC

Steps

1. Go to https://github.com/mozilla-mobile/fenix/blob/main/.github/ISSUE_TEMPLATE/release_checklist.md#sprint-x1-end-wednesday-2nd-week-cutting-a-beta
2. Search for Grant mozilla-release-automation-bot write access to this branch.
3. Click on mozilla-release-automation-bot
4. You will be taken to this repositoy https://github.com/mozilla-release-automation-bot where you will see the takeover message

PoC

• https://github.com/mozilla-release-automation-bot
• https://github.com/mozilla-mobile/fenix/blob/main/.github/ISSUE_TEMPLATE/release_checklist.md#sprint-x1-end-wednesday-2nd-week-cutting-a-beta

Impact

An attacker can takeover the account and when someone uses the template for sprint from the repository, they will end up giving access to attacker which can lead to malicious codes getting uploaded in mozilla repositories

Comment 1

[Arshad Kazmi [:arshadkazmi42]]

Attachment: Screenshot from 2021-10-28 23-10-32.png

Comment 2

[Greg G]

Hi Arshad, thanks for the report.

I can confirm to two links to https://github.com/mozilla-release-automation-bot and your takeover of that account at:

• https://github.com/mozilla-mobile/fenix/blame/main/.github/ISSUE_TEMPLATE/release_checklist.md#L34 / https://github.com/mozilla-mobile/fenix/blame/f3bf56ac600481ef8b6db7bea189f799a006b023/.github/ISSUE_TEMPLATE/release_checklist.md#L34
• https://github.com/mozilla-mobile/fenix/blame/main/.github/ISSUE_TEMPLATE/release_checklist.md#L40 / https://github.com/mozilla-mobile/fenix/blame/f3bf56ac600481ef8b6db7bea189f799a006b023/.github/ISSUE_TEMPLATE/release_checklist.md#L40

:st3fan can someone on your team unlink or update the links to https://github.com/mozilla-release-automation-bot mentioned about in the Fenix repo release checklist?

Comment 3

[Kevin Brosnan [Ex-Mozilla]]

I expect Amedyne and Aki are better suited to look at this than Stefan.

Comment 4

[Aki Sasaki (not active)]

https://github.com/mozilla-mobile/fenix/pull/22923

Comment 5

[Kevin Brosnan [Ex-Mozilla]]

I approved those edits.

Comment 6

[Arshad Kazmi [:arshadkazmi42]]

Hi,

I have verified the fix. This has been fixed.

Comment 7

[Daniel Veditz [:dveditz]]

Calling this sec-moderate because it's a low-chance but high impact issue. The current team members already know the procedure or would ask the people who know, but it's not impossible some new PM in the future could have gotten this wrong on their first attempt giving an eventual payoff.

Comment 8

[Arshad Kazmi [:arshadkazmi42]]

Thank you for the awesome bounty.

Let me know if mozilla wants to takeover this organization? So I can transfer it.

Otherwise I will just release the organization