Thousands of Firefox users accidentally commit login cookies on GitHub • The Register

Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions.

These cookies.sqlite databases normally reside in the Firefox profiles folder. They’re used to store cookies between browsing sessions. And they’re findable by searching GitHub with specific query parameters, what’s known as a search “dork.”

Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that “credentials exposed by our users are not in scope for our Bug Bounty program.”

Marlin then asked whether he could make his findings public and was told he’s free to do so.

“I’m frustrated that GitHub isn’t taking its users’ security and privacy seriously,” Marlin told The Register in an email. “The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they’d done, they’d s*** their pants.”

Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. “But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well,” he said, adding that he’s alerted the UK Information Commissioner’s Office because personal information is at stake.

Marlin speculates that the oversight is a consequence of committing code from one’s Linux home directory. “I imagine in most of the cases, the individuals aren’t aware that they’ve uploaded their cookie databases,” he explained. “A common reason users do this is for a common environment across multiple machines.”

An old issue, still unfixed

GitHub dorks are not new, but they often only affect a single service, like AWS, Marlin said. This particular gaffe is troubling because it could allow an attacker to access any internet-facing website to which the GitHub user was authenticated at the time the cookie files were committed. He added that dorks for other browsers can probably also be found.

Exploitation, Marlin said, would be very easy. It’s just a matter of creating a new Firefox profile on your local machine and then downloading the cookies.sqlite file and placing it within the Firefox profile folder. “You’ll be authenticated on any services which the user was logged in on when they committed the database,” explained Marlin.

There’s a theoretical complication. Firefox offers an option to protect logins and passwords. But as far as we can tell, that doesn’t apply to the cookies.sqlite file. The Register was able to examine multiple Firefox cookie databases with Marlin’s guidance.

When the visibility of cookies came up five years ago as a Firefox macOS bug submission, it was closed.

And even if the cookies.sqlite file were protected by a database-specific password, it probably wouldn’t offer much protection: Various open source projects offer the ability to crack .sqlite files, and there are commercial offerings of this sort too.

To underscore the seriousness of exposing these databases, consider this recently described Android PoC exploit of CVE-2020–15647, used to exfiltrate the Firefox cookies database.

Mozilla confirmed Marlin’s claims about the risk of exposing these files in an email to The Register on Thursday.

“Protecting the privacy of internet users is at the core of Mozilla’s work,” a Mozilla spokesperson said. “When using code hosting services, we encourage users to use caution when considering the sharing of private data directly on public websites. When choosing to backup sensitive Firefox profile data, Mozilla recommends Firefox Sync, which encrypts and safely stores files within Firefox servers.”

One mitigating factor at least is that sessions and associated cookies tend to expire relatively quickly.

There’s precedent for GitHub to take action to help those who have been unwittingly publishing their cookie databases. The social code biz has been scanning for exposed credentials in repos since 2015 and now scans for more than 70 different types of secrets. Here’s one more to add to the list.

GitHub did not respond to a request for comment. ®