GitBook Security Incident Review, Attack Targeting Trade.xyz

On November 5, GitBook released a review of the security incident that occurred on November 2. The attacker exploited a vulnerability in the single sign-on process to forge employee login sessions, query improperly configured GitHub App authentication information within the organization, access internal code repositories, and obtain Cloudflare API keys, ultimately gaining full production environment permissions. GitBook disabled the relevant internal service accounts to cut off the attack within hours, resulting in the platform being offline for approximately 16 hours, and it was fully restored on November 3 at 11:56 UTC. The attacker remained in the production environment for a total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and revoked customer keys and API tokens. GitBook stated that current indications show the attack targeted a single customer rather than the entire platform, and no other customer content has been found to be tampered with. However, since the attacker had access to customer data within the platform, it has been treated as if all customer data may have been exposed, involving API tokens, integration keys, session signature keys, assistant Q&A records, and authorized repository permissions for GitHub and GitLab applications. Billing information, passwords, and IP addresses were not affected. The speed and precision of the attack heavily relied on automation and AI. SlowMist's Chief Information Security Officer 23pds forwarded the review, stating that the targeted entity was Trade.xyz. Trade.xyz indicated that the document anomaly stemmed from an intrusion into GitBook's infrastructure, and there are no signs of compromise in its own infrastructure, and it will migrate away from GitBook within a few days.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.