The Anatomy of a 16-Hour Breach: GitBook's SSO Vulnerability

GitBook has published a detailed post-incident report outlining a security incident that began with a critical flaw in its Single Sign-On (SSO) system. This vulnerability provided attackers with a foothold that escalated into full production environment access.

The Attack Chain and Timeline

The intrusion started when attackers exploited a weakness in the SSO login flow to forge a valid employee session. Using this impersonated identity, they then accessed a misconfigured GitHub App. This step proved pivotal, granting them access to internal code repositories and critical Cloudflare API keys.

Armed with these keys, the attackers moved directly into the production environment. They leveraged service accounts to gain complete control over the infrastructure.

  • Nov 2, 16:32 UTC: Attackers obtain employee session and source code access.
  • 17:48: Entry into the production environment is achieved.
  • 19:58: GitBook engineers patch the SSO vulnerability.
  • 20:32: Account isolation and application takedown begins.

Service was not fully restored until Nov 3 at 11:56, following the completion of a full key rotation, resulting in approximately 16 hours of downtime.

Scope and Remediation Actions

During the periods of active access (about 2 hours 45 minutes on Nov 2 evening and 40 minutes early Nov 3), the attackers could reach a wide array of resources. This included GitBook API tokens, various integration tokens and keys, session signing keys, and authentication access to documentation sites. Access to code repositories on GitHub and GitLab, as well as some customer-hosted content, was also obtained.

Investigations found no evidence that customer billing information, passwords, or IP addresses were exfiltrated, nor was any customer content modified. GitBook's assessment points to a targeted attack against a single customer, but the company is operating under the assumption that all customer data was potentially exposed.

The response was comprehensive:

  • Full rotation of all infrastructure and customer keys.
  • Invalidation of all legacy API tokens.
  • The report notes the attack may have been driven by an AI agent.

The report, signed by CEO Sara Tandowsky and Co-founder & CTO Samy Pessé, underscores GitBook's commitment to transparency in the wake of this incident.