GitBook Security Incident Review: Attack Targeting Trade.xyz, SSO Vulnerability Leads to Production Environment Breach
GitBook released a security incident review on November 2, stating that attackers exploited a vulnerability in its single sign-on process to forge employee login sessions, allowing them to query improperly configured GitHub App authentication information within the organization, access internal code repositories, and obtain Cloudflare API keys, ultimately gaining full production environment permissions through service accounts.GitBook disabled the relevant internal service accounts to cut off the attack within hours, resulting in the platform being offline for approximately 16 hours, and fully restored on November 3 at 11:56 UTC. The attackers remained in the production environment for a total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and revoked customer keys and API tokens.GitBook stated that current indications show the attack targeted a single customer rather than the platform as a whole, and no other customer content has been found to be tampered with. However, since the attackers could access customer data within the platform, they are treating it as if all customer data may have been exposed, including API tokens, integration keys, session signing keys, assistant Q&A records, and authorized repository permissions for GitHub and GitLab applications. Billing information, passwords, and IP addresses were not affected.GitBook noted that the speed and precision of the attack heavily relied on automation and AI. Slow Mist's Chief Information Security Officer 23pds forwarded the review, stating that the targeted entity was Trade.xyz. Trade.xyz previously indicated that the document anomaly stemmed from an intrusion into GitBook's infrastructure, and there were no signs of their own infrastructure being compromised, and they will migrate away from GitBook within a few days.
