🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

Github Hack

4h 20mIntermediateJavaC#JavaScriptPythonGoTypeScript

A GitHub security bug allowed administrative privileges to any user's repositories. The bug was found in the framework library used to unbind user data. Let's find out what the security bug was and how to avoid it.

Begin course

Topics

  1. Introduction to Mass Assignment

    Lesson15m

    In March 2012, a security bug on GitHub granted an attacker admin access to user repositories by adding their SSH key. This bug could occur in programs that deserialise or unbind data from untrusted sources. Let's explore how this vulnerability works.

  2. Mass Assignment

    Lab40m

    Let's head to the lab to discover, debug, and fix this vulnerability within an actual application.

    PythonJavascriptGoTypeScriptJavaCsharp

  3. Lessons learnt

    Lesson5m

    Mass Assignment occurs when a program unbinds or deserializes untrusted data without safeguarding sensitive fields. This can lead to unauthorized changes in these fields and even affect database records. This bug can be missed, particularly in extensive codebases with multiple domain models and APIs. We must shield sensitive properties and avoid blind unbinding. Security flaws emerge when our program can't manage uncommon situations, enabling adversaries to exploit and cause harm.