GitBook Traces Production Breach to SSO Flaw; Trade.xyz Named as Target
Photo: TokenPost
GitBook’s Nov. 5 postmortem traced a breach of its documentation platform to a flaw in single sign-on (SSO), which let an attacker forge an employee login and reach production systems. GitBook said the attacker used authentication details from a misconfigured GitHub App to enter internal code repositories, obtain a Cloudflare API key and use a service account to gain production access. The attacker spent about three hours and 25 minutes in production. GitBook disabled the service accounts within hours, taking the platform offline for about 16 hours. Full service returned Nov. 3 at 6:56 a.m. ET (11:56 UTC).
Source: TokenPost
