Investigating for exploitation

With the immediate fix in place on github. com, we moved to the pressing question of whether anyone else found and exploited this vulnerability before the researchers reported it. A key property of this vulnerability gave us confidence in our ability to answer that question. The exploit forces the server to take a code path that is never used during normal operations on github. com.

This is not something an attacker can avoid or suppress, as it is an inherent consequence of how the injection works. We logged this path and queried our telemetry for any instance of this anomalous code path being executed. The results were clear: Every occurrence mapped to the Wiz researchers’ own testing activity. No other users or accounts triggered this code path. No customer data was accessed, modified, or exfiltrated as a result of this vulnerability.

For GHES customers, exploitation would require an authenticated user with push access on your instance. We recommend reviewing your access logs out of an abundance of caution.