CyberRota Analysis
AI-GeneratedThe vulnerability affects Atlantis versions up to 0.47.1, where the /github-app/setup endpoint lacks proper authentication, allowing unauthenticated attackers to access sensitive GitHub App credentials. This can lead to the interception of the GitHub redirect, enabling attackers to obtain the RSA private key and webhook secret, which facilitates installation token minting and webhook payload forgery. Organizations using affected versions of Atlantis should prioritize patching this vulnerability to protect their GitHub integrations from unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.