HOW WE EXPLOITED CODERABBIT: FROM A SIMPLE PR TO RCE AND WRITE ACCESS ON 1M REPOSITORIES

Summary from the TLDR Web Dev newsletter

A vulnerability in CodeRabbit, an AI code review tool, allowed for remote code execution (RCE) on its production servers. By exploiting Rubocop, a static analysis tool integrated with CodeRabbit, the Kudelski Security team was able to inject malicious code and exfiltrate sensitive environment variables, including API keys and secrets. This access granted them potential read and write access to 1 million code repositories, including private ones, through the leaked CodeRabbit GitHub app private key. CodeRabbit quickly fixed the vulnerability by disabling Rubocop, rotating secrets, and implementing stronger security measures.