Source credentials are chosen by substring test and offered to arbitrary hosts
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- azure, csharp, git
- Domain
- authentication, devops, security
Research direction
Trace the isAzureDevOpsRepo host check, the git credentials callback, and AzureDevOpsServerWebClient's azureEndpoint decision. Start by locating these entry points and verify how clone redirects and non-matching hosts are handled. Done means crafted substring hosts receive no credential, legitimate hosts still receive the correct one, and default Windows credentials are never offered outside the allow-list.
Written by the indexing model from the issue text.
Description
Problem
Three legs, all the same defect: a credential selected by a substring test over attacker-settable URL text.
The Entra bearer token. isAzureDevOpsRepo = url.Contains("dev.azure.com") || url.Contains("visualstudio.com") — satisfied by https://dev.azure.com.attacker.net/repo.git, which then receives an access token issued to DOrc's own application registration, scoped to no particular repository.
The Terraform PAT. The git credentials callback ignores the URL it is asked about. libgit2 invokes it for every URL it authenticates against during a clone, redirect targets included — so a repository that redirects elsewhere collects the PAT or the Entra token without the redirect ever appearing in project configuration for anyone to notice.
Default Windows credentials. AzureDevOpsServerWebClient decides on azureEndpoint.Contains(azureEndpointUrl); everything failing that test falls into an else branch offering UseDefaultCredentials = true — the API service account's Windows credentials — to whatever host the project names. This is the leg no token-scoping fix would catch, because it hands over an interactive service identity rather than a scoped token.
Weaknesses
W-11, W-16.
Acceptance
- A URL crafted to contain an allow-listed host as a substring of an attacker-controlled host attracts no credential.
- Legitimate hosts continue to receive the correct credential.
- No path offers default Windows credentials to a host that is not allow-listed.
- Dominant language
- C#
- Stars
- 5
- Forks
- 3
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 14
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sefe/dorc
-
Close out the deployment privilege containment sequence, and record what "delivered" does not mean Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
DORC UT 02
-
area:ui
-
DORC DV 02
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
:watch: Not Triaged 11.0 fundamentals/subsvc
Difficulty 2/5 1-3 hours Newbie friendliness 92/100
dotnet/AspNetCore.Docs#37699 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
SubtitleEdit/subtitleedit#15108 · 1 comment ·
-
area/docs-content Bug pulumi/docs
Difficulty 1/5 1-3 hours Newbie friendliness 94/100
-
agentic-workflows untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 76/100