CAPEC-695 Detail

An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.

Execution Flow

[Identify target] The adversary must first identify a target repository that is commonly used and whose owner/maintainer has either changed/deleted their username or transferred ownership of the repository and then deleted their account. The target should typically be a popular and widely used package, as to increase the scope of the attack.

[Recreate initial repository path] The adversary re-registers the account that was renamed/deleted by the target repository's owner/maintainer and recreates the target repository with malicious code intended to exploit an application. These steps may need to happen in reverse (i.e., recreate repository and then rename an existing account to the target account) if protections are in place to prevent repository reuse.

[Exploit victims] The adversary's malicious code is incorporated into applications that directly reference the initial repository, which further allows the adversary to conduct additional attacks.

Prerequisites

Identification of a popular repository that may be directly referenced in numerous software applications
A repository owner/maintainer who has recently changed their username or deleted their account

Skills Required

Ability to create an account on a VCS hosting site and recreate an existing directory structure.
Ability to create malware that can exploit various software applications.

Mitigations

Leverage dedicated package managers instead of directly linking to VCS repositories.
Utilize version pinning and lock files to prevent use of maliciously modified repositories.
Implement "vendoring" (i.e., including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously.
Leverage automated tools, such as Checkmarx's "ChainJacking" tool, to determine susceptibility to Repo Jacking attacks.

Related Weaknesses

References

REF-722

Repo Jacking: Exploiting the Dependency Supply Chain
Indiana Moreau.
https://www.concretecms.org/about/project-news/security/supply-chain-hack-phpass-repo-jacking

REF-732

CyRC Vulnerability Analysis: Repo jacking in the software supply chain
Theo Burton.
https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-analysis-repo-jacking/

REF-733

Attacker Caught Hijacking Packages Using Multiple Techniques to Steal AWS Credentials
Jossef Harush.
https://checkmarx.com/blog/attacker-caught-hijacking-packages-using-multiple-techniques-to-steal-aws-credentials/

REF-734

GitHub RepoJacking Weakness Exploited in the Wild by Attackers
Jossef Harush.
https://checkmarx.com/blog/github-repojacking-weakness-exploited-in-the-wild-by-attackers/

Submission

Modifications