Incident involving unauthorized admin entry

TL;DR: Sourcegraph skilled a safety incident that allowed a single attacker to entry some knowledge on Sourcegraph.com. This was restricted to:

• Paid clients:
  • The license key recipient’s identify and e mail handle.
  • A small subset of consumers’ Sourcegraph license keys might have been accessed (observe that license keys don’t allow entry to Sourcegraph cases). We’re reaching out on to those that might have been impacted to rotate license keys.
• Neighborhood customers:
  • Sourcegraph account e mail addresses. No motion is required.

No different buyer information, together with personal code, emails, passwords, usernames, or different PII, was accessible.

Background

Sourcegraph skilled a safety incident on August 30, 2023 the place a malicious actor used a leaked admin entry token in our public Sourcegraph occasion at Sourcegraph.com. The malicious exterior person used their privileges to extend API price limits for a small variety of customers.

On August 30, 2023 our workforce seen a major improve in API utilization and commenced investigating the trigger.

The spike in utilization was dominated as remoted and inorganic and our safety, engineering, and help groups shortly assembled to know what was occurring.

Our safety workforce recognized a code commit from July 14 the place a site-admin entry token was unintentionally leaked in a pull request and was leveraged to impersonate a person to realize entry to the executive console of our system.

Within the spirit of transparency, we need to share the complete timeline of the incident and what we’ve got accomplished to resolve this incident, in addition to extra steps we’re taking to forestall this sort of leak sooner or later.

Timeline

On July 14, 2023 (2023-07-14 22:01:00 UTC) a Sourcegraph engineer unintentionally dedicated a code change that contained an lively site-admin entry token. The positioning-admin entry token had broad privileges to view and modify account info on Sourcegraph.com.

Sourcegraph.com is an occasion of Sourcegraph that comprises public code solely. It’s additionally used for authentication for free-tier Cody customers. It’s separate from all paid buyer cases (each on-premises and cloud). The occasion additionally hosts our license administration for all clients.

Our inside management techniques, together with automated code evaluation, didn’t catch the entry token being dedicated to the repository.

On August 28, 2023 (2023-08-28 13:18:36 UTC), a person created a model new Sourcegraph account.

On August 30, 2023 (2023-08-30 06:47:59 UTC), utilizing the leaked site-admin entry token, this person elevated their account privileges to a site-admin and gained unauthorized entry to the admin dashboard.

The malicious person continued to probe the system by altering their entry from a site-admin to common person a number of occasions.

The malicious person, or somebody related to them, created a proxy app permitting customers to instantly name Sourcegraph’s APIs and leverage the underlying LLM. Customers had been instructed to create free Sourcegraph.com accounts, generate entry tokens, after which request the malicious person to vastly improve their price restrict.

On August 30 (2023-08-30 13:25:54 UTC), the Sourcegraph safety workforce recognized the malicious site-admin person, revoked their entry, and kicked off an inside investigation for each mitigation and subsequent steps.

Influence

The promise of free entry to Sourcegraph API prompted many to create accounts and begin utilizing the proxy app. The app and directions on the way to use it shortly made its manner throughout the net, producing near 2 million views.

As extra customers found the proxy app, they created free Sourcegraph.com accounts, including their entry tokens, and accessing Sourcegraph APIs illegitimately.

The impression of the malicious person having admin entry was restricted to a subset of:

• Paid Prospects
  • The license key recipient’s identify and e mail handle
  • Sourcegraph license key

• Free-Tier Neighborhood Customers

We have now no indication that any of this knowledge was considered, modified, or copied, however the malicious person may have considered license key recipient’s emails and neighborhood person e mail addresses as they navigated the admin dashboard.

Necessary Notice: Prospects’ personal knowledge or code was not considered throughout this incident. Buyer personal knowledge and code resides in remoted environments and had been due to this fact not impacted by this occasion.

How we’re mitigating

As quickly as we understood the scope of the incident we took the next steps:

• Recognized the malicious account and absolutely revoked its entry
• Proactively rotated a subset of Sourcegraph buyer license keys that will have been considered
• Quickly diminished the speed limits for all free neighborhood customers
• Created new processes and assessments and can proceed to observe for malicious exercise and abuse

Increasing our secret scanning via extra static evaluation assessments will guarantee we are able to higher detect and stop this sort of leak sooner or later.

In the event you’re a Neighborhood person, we all know these price restrict reductions aren’t preferrred for devs who’re utilizing Cody to assist them write and perceive code. This discount might be short-term whereas we examine the difficulty additional.

Subsequent steps

Our groups are actively working to create a long-term resolution for our neighborhood and clients to forestall future incidents like this. Whereas we’re not able to publicly share our extra mitigation choices right now as our inside investigation remains to be ongoing, know that we’re working across the clock to implement an answer that’s least disruptive to the Sourcegraph neighborhood at massive.

Keep tuned for extra updates and make sure to be part of our Discord community for the newest.

FAQ

Is my code host knowledge compromised?

No personal buyer knowledge or code was accessible.

Is there any motion that I must take?

In case you are a part of the subset of consumers whose Sourcegraph license keys might have been accessed, your account workforce will attain out with steps and a brand new license key as quickly as attainable. Notice: The Sourcegraph license key doesn’t allow any entry to a buyer occasion.

Without cost-tier customers with a Sourcegraph.com account: No motion is required.

What e mail addresses had been viewable?

• Paid clients: When a Sourcegraph buyer receives their license, they supply one e mail handle to affiliate with their license key. Solely this recipient e mail is saved in Sourcegraph.com and no different buyer emails had been accessible.
• Neighborhood customers: Sourcegraph.com account e mail addresses.

I’ve extra questions, who can I contact?

Attain out to your Account workforce (Technical Advisor or Account Government) or our Help workforce at support@sourcegraph.com.