Poisoned Pipeline / Techniques / T0115
Repojacking
Dependency repository hijacking (aka repo jacking) is an obscure supply chain vulnerability, conceptually similar to subdomain takeover, that impacts over 70,000 open-source projects and affects everything from web frameworks to cryptocurrencies.
This vulnerability is trivial to exploit, results in remote code injection, and affects major projects from companies like Google, GitHub, Facebook, Kubernetes, NodeJS, Amazon, and many others.
Every project whose compilation depends on dynamically linked code from GitHub repositories is potentially vulnerable.
When the linked repository owner changes their username, it becomes immediately available to be re-registered by anyone.
This means that any project that linked back to the original repository URL has now become vulnerable to remote code injection through dependency hijacking.
A malicious attacker can register the old GitHub username, recreate the repository, and use it to serve malicious code to any project that depends on it.
Where this idea came from
Security Innovation repo-jacking write-up; DEF CON 34: “Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks” (Silva) — same unclaimed-name takeover in the VS Code fork ecosystem (see AS29).
- https://blog.securityinnovation.com/repo-jacking-exploiting-the-dependency-supply-chain
- https://github.blog/2018-04-18-new-tools-for-open-source-maintainers/#popular-repository-namespace-retirement
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66645
Mitigations
- M1502 Define trusted package managers and repositories
- M1720 Implement regular patches and updates
- M1730 Implement code reviews
- M1732 Implement code scanning for security risks
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries