GitBook Security Incident: Attack Targeted Trade.xyz via SSO Vulnerability

ChainCatcher report: GitBook’s post-incident review of the security incident on November 2 states that the attacker exploited a vulnerability in its single sign-on process to forge employee login sessions, then queried improperly configured GitHub App credentials within the organization, gained access to internal code repositories, and obtained Cloudflare API keys, ultimately acquiring full production environment privileges via a service account. GitBook disabled the relevant internal service accounts within hours to halt the attack, resulting in a platform outage of approximately 16 hours, with full restoration completed on November 3 at 11:56 UTC. The attacker remained in the production environment for a total of approximately 3 hours and 25 minutes. GitBook has rotated all infrastructure and customer-hosted keys and revoked all API tokens. GitBook stated that current evidence suggests the attack targeted a single customer rather than the platform as a whole, with no indication that other customers’ content was altered. However, since the attacker had access to customer data within the platform, all customer data is being treated as potentially exposed, including API tokens, integration keys, session signing keys, assistant Q&A logs, and GitHub and GitLab app permissions for authorized repositories. Billing information, passwords, and IP addresses were unaffected. GitBook noted that the speed and precision of the attack heavily relied on automation and AI. 23pds, Chief Information Security Officer at SlowMist, shared this review, indicating that the targeted entity was Trade.xyz. Trade.xyz previously stated that the document anomalies stemmed from a compromise of GitBook’s infrastructure, with no signs of compromise to its own infrastructure, and plans to migrate away from GitBook within days.