Description
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coderamp-labs | gitingest | ≤ 0.3.1 | — |
References
- GitHub Issue #592 issue-tracking
- https://github.com/coderamp-labs/gitingest product
- Vulnerable code: query_parser_utils.py technical-description
- Vulnerable code: git_utils.py technical-description
- VulnCheck Advisory: Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure third-party-advisory