{"id":117354,"date":"2024-07-12T09:43:01","date_gmt":"2024-07-12T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python"},"modified":"2024-07-12T09:43:01","modified_gmt":"2024-07-12T07:43:01","slug":"utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","title":{"rendered":"Token leak for full access to the project's GitHub repositories.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from JFrog discovered a token embedded in the Docker image 'cabotage-app' that provided admin access to the Python repositories, PyPI, and the Python Software Foundation on GitHub. The token was found in the binary file '__pycache__\/build.cpython-311.pyc' containing cached compiled bytecode.
<\/center> <\/p>\n
According to representatives from the PyPI repository, the token was created in 2023 for developer ewdurbin (Ee Durbin), who serves as the director of infrastructure at the Python Software Foundation. The token provided administrator access to all repositories and organizations of the project, including all repositories of the organizations pypi, python, psf, and pypa. The problematic Docker image containing the token was published on the Docker Hub catalog on March 3, 2023, and removed on June 11, 2024, meaning it was publicly accessible for 16 months. The token was revoked on June 28. <\/p>\n
Notably, the available source codes that served as the basis for the problematic bytecode file do not mention the token. The code author explained that during the development of the cabotage-app5 toolkit on their local system, they encountered restrictions on the frequency of API requests to GitHub while automating file uploads from GitHub. To bypass the limits set for anonymous requests to GitHub, they temporarily added their work token into the code. Before publishing the written code, the token was removed, but the developer did not consider that the mention of the token was cached in the precompiled bytecode file, which then ended up in the Docker image. def _fetch_github_file( \u2014 github_repository='owner\/repo', ref='main', access_token=None, filename='Dockerfile' + github_repository='owner\/repo', + ref='main', + access_token='0d6a9bb5af126f73350a2afc058492765446aaad', + filename='Dockerfile', ): <\/p>\n
An audit of activity in the repositories on GitHub conducted by Python developers found no unauthorized access attempts using the disclosed token. Given that GitHub has been the primary platform for the development of CPython since 2017, the token falling into the hands of a malicious actor could have led to a complete compromise of the infrastructure used for Python development and the PyPI repository, and the potential for attempts to integrate backdoors into CPython and the PyPI package manager. <\/p>\n
The incident highlights the importance of analyzing leaks not only in source code, configuration files, and environment variables but also in binary files. In the context of Python, users are also advised to pay attention to the presence of pyc files with compiled bytecode in downloaded projects, as these files may contain hidden modifications not present in the source code. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Token](\"\/wp-content\/uploads\/2024\/07\/995cd4986ccb553d612c78345dfec4ad.png\")
<\/center> <\/p>\n