OAuth Token Theft Campaign Targets GitHub Users via Heroku, Travis CI
On April 12, GitHub Security launched an investigation after uncovering evidence that an attacker abused stolen OAuth user tokens issued to two third-party integrators, Heroku and Travis CI, to download data from dozens of organizations — including npm. The affected OAuth applications were used by GitHub users and by GitHub itself. GitHub does not believe the attacker obtained these tokens via a compromise of GitHub or its own systems, as the tokens are not stored by GitHub in their original, usable formats. GitHub disclosed its findings to Heroku and Travis CI on April 13 and 14.
GitHub's analysis indicates the stolen tokens were abused to download private repositories belonging to dozens of victim organizations using the affected apps. GitHub assesses that the attackers may have been mining the downloaded private repository contents — to which the stolen token had legitimate access — for secrets that could be used to pivot into other infrastructure. The known-affected OAuth applications as of April 15, 2022 are:
- Heroku Dashboard (ID: 145909)
- Heroku Dashboard (ID: 628778)
- Heroku Dashboard – Preview (ID: 313468)
- Heroku Dashboard – Classic (ID: 363831)
- Travis CI (ID: 9216)
GitHub shared the details publicly because the attacks may be ongoing and action is required for affected customers to protect themselves.
Impact on npm and GitHub.com
The initial detection came on April 12, when GitHub Security identified unauthorized access to its npm production infrastructure using a compromised AWS API key. Subsequent analysis suggests the attacker obtained this key after downloading a set of private npm repositories using a stolen OAuth token from one of the two affected third-party applications. After discovering the broader theft on the evening of April 13 — tokens not stored by GitHub or npm — GitHub revoked the tokens associated with GitHub and npm's internal use of the compromised applications.
The two impacts to npm are unauthorized access to and downloading of private repositories in the npm organization on GitHub.com, and potential access to npm packages as they exist in AWS S3 storage. GitHub currently assesses that the attacker did not modify any packages or access user account data or credentials. The company is still working to determine whether the attacker viewed or downloaded private packages. npm runs on completely separate infrastructure from GitHub.com; GitHub was not affected in the original attack. As the investigation continues, GitHub has found no evidence that other GitHub-owned private repos were cloned using stolen third-party OAuth tokens.
GitHub's Response and Customer Guidance
After identifying the stolen OAuth tokens, GitHub contacted Heroku and Travis CI to request their own security investigations, the revocation of all OAuth user tokens associated with the affected applications, and notification of their own users. GitHub remains closely engaged with both organizations.
GitHub is identifying and notifying all known-affected victim users and organizations discovered through its analysis. Those customers receive a notification email with additional details and next steps. If no notification is received, the account has not been identified as affected. GitHub will continue to notify additional affected users as they are identified. Users are advised to periodically review what OAuth applications they've authorized or that are authorized to access their organization and prune anything no longer needed. Organization audit logs and user account security logs should be reviewed for unexpected or anomalous activity.
Customers with questions about Heroku-maintained OAuth applications can reach Salesforce/Heroku security and support at help.heroku.com and monitor the Salesforce Trust site. Travis CI inquiries go to [email protected]. Customers directly contacted by GitHub may reach out per the directions in their notification; other questions go to GitHub Support.
Ongoing Investigation Updates
As of April 18, 2022, GitHub had notified victims identified as having repository contents downloaded by an unauthorized party through the abuse of the third-party OAuth tokens. By April 22, GitHub had also notified victims whose repository details had been listed — but whose contents had not been downloaded — using the /user/repos and /orgs/{org}/repos GitHub API endpoints. As of April 27, GitHub was in the process of sending the final expected notifications to customers who had either the Heroku or Travis CI OAuth app integrations authorized in their accounts.
Attacker Activity Pattern
GitHub's analysis of the attacker's behavior on GitHub.com, using stolen OAuth tokens, reveals a consistent pattern:
- The attacker authenticated to the GitHub API using stolen OAuth tokens issued to Heroku and Travis CI.
- For most people with affected apps authorized, the attacker listed all the user's organizations.
- The attacker then selectively chose targets based on the listed organizations.
- The attacker listed the private repositories for accounts of interest.
- The attacker cloned some of those private repositories.
This behavior suggests the attacker was listing organizations to identify accounts to selectively target for repository listing and downloading. GitHub believes the attacks were highly targeted, based on available information and analysis of the attacker's behavior. Customers should continue to monitor Heroku and Travis CI for updates on their own investigations into the affected OAuth applications.
