PT-2023-31626 · Github · Octokit/Webhooks+1

Nickfloyd + 2 · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50728

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions octokit/webhooks versions 9.26.0 through 9.26.2 octokit/webhooks versions 10.9.0 through 10.9.1 octokit/webhooks versions 11.1.0 through 11.1.1 octokit/webhooks versions 12.0.0 through 12.0.3

Description The issue is caused by a problem with error handling in the @octokit/webhooks library, where the error can be undefined in some cases, resulting in an uncaught exception that ends the nodejs process. This problem was encountered during a pentest and is specifically related to the octokit/webhooks library, a dependency of Probot, a framework for building Github Apps.

Recommendations For octokit/webhooks versions 9.26.0 through 9.26.2, update to version 9.26.3. For octokit/webhooks versions 10.9.0 through 10.9.1, update to version 10.9.2. For octokit/webhooks versions 11.1.0 through 11.1.1, update to version 11.1.2. For octokit/webhooks versions 12.0.0 through 12.0.3, update to version 12.0.4. As a general recommendation, it is advised to upgrade to the latest version of octokit/webhooks.js or use one of the updated backported versions.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2023-50728

GHSA-PWFR-8PQ7-X9QV

Affected Products

Probot

Octokit/Webhooks

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50728.json · Exploit
• https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50728 · Security Note
• https://osv.dev/vulnerability/GHSA-pwfr-8pq7-x9qv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50728 · Vendor Advisory
• https://github.com/probot/probot/releases/tag/v12.3.3 · Note
• https://github.com/octokit/octokit.js/releases/tag/v3.1.2 · Note
• https://github.com/octokit/webhooks.js · Note
• https://github.com/octokit/webhooks.js/releases/tag/v9.26.3 · Note
• https://github.com/octokit/webhooks.js/releases/tag/v11.1.2 · Note
• https://github.com/octokit/webhooks.js/releases/tag/v12.0.4 · Note
• https://github.com/octokit/webhooks.js/releases/tag/v10.9.2 · Note
• https://github.com/octokit/app.js/releases/tag/v14.0.2 · Note
• https://twitter.com/CVEnew/status/1735946014710993098 · Twitter Post