CVE-2022-39304

low-risk
Published 2022-12-20

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.0/10 Medium
LOCAL / HIGH complexity

Affected Products (1)

Ghinstallation

Affected Vendors

Ghinstallation Project

References (8)

Technical Description https://docs.github.com/en/developers/apps/building-github-apps/authenticating-w...
Exploit https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff7...
Patch https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e...
Patch https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96...
Technical Description https://docs.github.com/en/developers/apps/building-github-apps/authenticating-w...
Exploit https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff7...
Patch https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e...
Patch https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96...
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal