GHSA-656w-6f6c-m9r6
HIGHOneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
@oneuptime/commonReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Summary
OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding.
Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project.
Details
The callback decodes unsigned base64 JSON from state and uses the embedded projectId directly:
It then writes the supplied installation_id into the target project with root privileges:
await ProjectService.updateOneById({
id: new ObjectID(projectId),
data: { gitHubAppInstallationId: installationId },
props: { isRoot: true },
});
The userId in state is only checked for presence, not authenticity:
The install flow also generates state as plain base64 JSON, not a signed or session-bound token:
The follow-on endpoints are also vulnerable:
- Repository listing: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258
- Repository connect: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356
- Middleware allows requests with no token to continue as
Public: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211 - Installation tokens are minted from any valid installation ID: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425
PoC
Minimal proof of unauthorized project tampering:
STATE=$(printf '%s' '{"projectId":"<victim-project-uuid>","userId":"x"}' | base64 | tr -d '\n')
curl -isk "https://<host>/api/github/auth/callback?installation_id=999999999&state=${STATE}"
Expected result:
- Server returns a
302redirect to/dashboard/<victim-project-uuid>/code-repository?installation_id=999999999 - The target project's
gitHubAppInstallationIdis overwritten
Impact
- Unauthorized modification of
Project.gitHubAppInstallationId - Temporary GitHub integration breakage if a bogus installation ID is set
- Cross-project binding of attacker-controlled GitHub App installations
- Repository metadata disclosure for a supplied valid installation ID
- Unauthorized creation of
CodeRepositoryrecords in arbitrary projects
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @oneuptime/common | all versions | 10.0.19 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @oneuptime/common. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @oneuptime/common to 10.0.19 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-656w-6f6c-m9r6 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-656w-6f6c-m9r6 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-656w-6f6c-m9r6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-656w-6f6c-m9r6 in your dependencies?
O3 detects GHSA-656w-6f6c-m9r6 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.