Threats tagged 'ghsa-f5f4-3hh4-f54m'

Pipelines-as-Code versions prior to 0.48.0, 0.42.1, 0.39.6, and 0.37.8 are vulnerable to credential exfiltration via the GitHub App webhook endpoint. The vulnerability arises because the application accepts the X-GitHub-Enterprise-Host header without proper validation before generating GitHub App tokens, allowing an attacker to redirect token requests to a malicious host. This can lead to exposure of the GitHub App JWT, enabling token minting within the JWT validity window. The issue is fixed by validating webhook signatures before token generation and verifying the Enterprise host against the repository URL. Operators are advised to block or strip unexpected headers and restrict webhook endpoint access until patched.