GitBook Security Incident Retrospective: Attack Targeted Trade.xyz, SSO Vulnerability Led to Production Environment Compromise

BlockBeats news, November 5 - GitBook released a review of the security incident on November 2, stating that attackers exploited a vulnerability in its single sign-on process to forge employee login sessions, then queried improperly configured GitHub App authentication information within the organization, entered internal code repositories and obtained Cloudflare API keys, ultimately gaining full production environment access via a service account. GitBook disabled the relevant internal service accounts within hours to cut off the attack, causing the platform to go offline for approximately 16 hours, and fully restored by 11:56 UTC on November 3. The attackers stayed in the production environment for a cumulative total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and hosted customer keys and invalidated API tokens.

GitBook stated that current indications show the attack targeted a single customer rather than the platform as a whole, and no tampering with other customers' content has been found. However, because the attackers could reach customer data within the platform, it has handled the matter on the basis that all customer data may have been exposed, involving API tokens, integration keys, session signing keys, assistant Q&A records, and GitHub and GitLab app permissions for authorized repositories, etc. Billing information, passwords, and IP addresses were not affected. GitBook said the speed and precision of the attack relied heavily on automation and AI. SlowMist Chief Information Security Officer 23pds forwarded the review, stating that the named target is Trade.xyz. Trade.xyz previously said that the documentation anomalies came from a compromise of GitBook's infrastructure, that there were no signs of its own infrastructure being breached, and that it would migrate away from GitBook within days.