Publicly editable GitHub wikis
High
Vulnerability Details
Hello team,
While browsing `https://github.com/liberapay` I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories:
```
https://github.com/liberapay/cardregistration-js-kit/wiki
https://github.com/liberapay/mangopay2-python-sdk/wiki
```
I went on and created the following wiki page as a PoC:
`https://github.com/liberapay/cardregistration-js-kit/wiki/PoC`
## Impact
This enables an attacker to edit the wiki pages of the affected repositories completely remotely, adding content that may link to malicious code libraries that would be installed and used by developers or information that may mislead your users.
Actions
View on HackerOneReport Stats
- Report ID: 460121
- State: Closed
- Substate: not-applicable
- Upvotes: 2