# How I gained commit access to Homebrew in 30 minutes

DevFeed: [How I gained commit access to Homebrew in 30 minutes](<https://devfeed.tech/articles/how-i-gained-commit-access-to-homebrew-in-30-minutes-31927.md>)

Original publisher: [Read original article](<http://engineering.remind.com/how-I-gained-commit-access-to-homebrew/>)

Author: Remind

Published: 2018-08-07T00:00:00Z

Content type: article

Language: en

Sources: [Remind](<https://devfeed.tech/sources/remind.md>)

Topics: [Homebrew](<https://devfeed.tech/topics/homebrew.md>), [Security](<https://devfeed.tech/topics/security.md>), [supply chain attacks](<https://devfeed.tech/topics/supply-chain-attacks.md>), [Jenkins](<https://devfeed.tech/topics/jenkins.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Environment Variables](<https://devfeed.tech/topics/environment-variables.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [GitHub API](<https://devfeed.tech/topics/github-api.md>), [incident](<https://devfeed.tech/topics/incident.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [curl](<https://devfeed.tech/tags/curl.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [github](<https://devfeed.tech/tags/github.md>), [homebrew](<https://devfeed.tech/tags/homebrew.md>), [incident](<https://devfeed.tech/tags/incident.md>), [jenkins](<https://devfeed.tech/tags/jenkins.md>), [npm](<https://devfeed.tech/tags/npm.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [rubygems](<https://devfeed.tech/tags/rubygems.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

## AI overview

A security researcher describes gaining commit access to Homebrew repositories through a GitHub API token exposed in a publicly accessible Jenkins environment. The access was tested and then reported to Homebrew maintainers, highlighting risks to package-manager infrastructure and software supply chains.

## Source excerpt

This issue was publicly disclosed on the Homebrew blog at https://brew.sh/2018/08/05/security-incident-disclosure/ Since the recent NPM, RubyGems, and Gentoo incidents, I've become increasingly interested, and concerned, with the potential for package managers to be used in supply chain attacks to distribute malicious software. Specifically with how the maintainers and infrastructure of these projects can be targeted as an attack vector. On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew's GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. Let's get leaky My initial strategy going in was based on credential theft; find if there were any credentials leaked by members of the Homebrew GitHub org. An OSSINT tool from Michael Henriksen called gitrob makes automating this search really easy. I ran it across the Homebrew organization, but ultimately didn't come up with anything interesting. Next, I took a look at previously disclosed issues on https://hackerone.com/Homebrew. From there, I found that Homebrew runs a Jenkins instance that's (intentionally) publicly exposed at https://jenkins.brew.sh. After some digging, I noticed something interesting; builds in the "Homebrew Bottles" project were making authenticated pushes to the BrewTestBot/homebrew-core repo: This got me thinking, "where are the credentials stored?". I noticed the "Environment Variables" link on the left, which led to an exposed GitHub API token: I tested it locally to see what scopes the token had: $ curl https://api.github.com/user/repos -u $GITHUB_API_TOKEN:x-oauth-basic | jq '.[] | {repo: .full_name, permissions: .permissions}' { "repo": "BrewTestBot/homebrew-core", "permissions": { "admin": true, "push": true, "pull": true } } { "repo": "Homebrew/brew", "permissions": { "admin": false, "push": true, "pull": true } } { "repo": "Homebrew/formulae.brew.sh", "permissions": { "admin": false, "push": true, "pull": true } } { "