GitBook Traces Production Breach to SSO Flaw; Trade.xyz Named as Target

GitBook’s Nov. 5 postmortem traced a breach of its documentation platform to a flaw in single sign-on (SSO), which let an attacker forge an employee login and reach production systems.

GitBook said the attacker used authentication details from a misconfigured GitHub App to enter internal code repositories, obtain a Cloudflare API key and use a service account to gain production access. The attacker spent about three hours and 25 minutes in production.

GitBook disabled the service accounts within hours, taking the platform offline for about 16 hours. Full service returned Nov. 3 at 6:56 a.m. ET (11:56 UTC).

SlowMist security chief 23pds identified Trade.xyz as the targeted customer in a repost of the postmortem. Trade.xyz said its own infrastructure showed no signs of compromise and that it planned to move its documentation away from GitBook in the coming days.

GitBook said it found no evidence that other customers’ content had been altered, but treated all customer data as potentially exposed because the attacker could access it. The data categories included API tokens, integration keys, session-signing keys, assistant question-and-answer records and permissions for authorized GitHub and GitLab apps. Billing information, passwords and IP addresses were not affected. GitBook rotated infrastructure and hosted customer keys and revoked API tokens.