Github Intentionally Lets You Read Deleted & Private Commits
Source: YouTube · John Hammond · published Oct 8, 2024 · 28:36
GitHub allows access to deleted and private repository data via dangling commits, creating a significant security vulnerability 0:30. This is known as crossfork object reference (CFOR), where commit hashes from forks remain accessible even after the original repository is deleted or made public 1:01.
Key Takeaways:
• Deleted forks and private repositories still retain commit data accessible via commit hashes 1:49.
• A user can access sensitive data (e.g., API keys) from deleted forks by brute-forcing short SHA-1 hashes (4–6 characters) 3:00.
• Truffle Security tested this and found 40+ valid API keys from deleted forks of large AI company repositories 6:16.
• Commits made to a forked repository remain accessible even after the upstream repository is deleted or made public 13:34.
• GitHub's intentional design allows this, but awareness among developers is low despite documentation 27:14.
This attack surface is real, exploitable, and highlights a critical gap in developer awareness, even though it is documented.
Sources:
- 0:30 GitHub intentionally allows access to deleted repository data via commit hashes.
- 1:01 Crossfork object reference (CFOR) enables access to commits from forks.
- 1:49 Example of deleted fork data still being accessible.
- 3:00 Brute-forcing short SHA-1 hashes to access commit data.
- 6:16(https://www.youtube.com/watch?v=DYdMX
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
anyone can access deleted and private repository data on GitHub now this is a write up a little bit of an article that was put out by truffle security way back in July of this year and I would like to walk through it like to Showcase it maybe do a couple demos here it says you can access data from deleted Forks deleted repositories and even private repositories on GitHub this is known by GitHub it's known information and it's intentionally designed that way but it could very well be considered an attack vector and honestly they thought this is worth some whole new term coining some phrase here crossfork object reference or CF very similar to an insecure direct object reference or an ID door CF user Supply the commit hashes to directly access commit data that otherwise would not have been v…