CVE-2016-10526 grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
The plugin logs GitHub tokens to the console, potentially exposing credentials to attackers if CI logs are public.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10526?
CVE-2016-10526 is a high-severity vulnerability in HackerOne grunt-gh-pages node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
Which versions are affected by CVE-2016-10526?
2 open source packages ship an affected version, including grunt-gh-pages. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grunt-gh-pages npm | All versions | 0.10.0 |
grunt-gh-pages npm | All versions | 0.10.0 |
Products include Grunt-Gh-Pages Project Grunt-Gh-Pages.
How do I fix CVE-2016-10526?
Upgrade grunt-gh-pages to 0.10.0 or later.
Is CVE-2016-10526 being exploited?
There is no known exploitation of CVE-2016-10526 in the wild and no public exploit code.
Sources
Also known as GHSA-rrj3-qmh8-72pf.