CAPEC Definitions / CAPEC-695
CAPEC-695: Repo Jacking
An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.
Extended Description
Software developers may directly reference a VCS repository (i.e., via a hardcoded URL) within source code to integrate the repository as a dependency for the underlying application. If the repository owner/maintainer modifies the repository name, changes their VCS username, or transfers ownership of the repository, the VCS implements a redirect to the new repository location so that existing software referencing the repository will not break. However, if the original location of the repository is reestablished, the VCS will revert to resolving the hardcoded path. Adversaries may, therefore, re-register deleted or previously used usernames and recreate repositories with malicious code to infect applications referencing the repository. When an application then fetches the desired dependency, it will now reference the adversary's malicious repository since the hardcoded repository path is once again active. This ultimately allows the adversary to infect numerous applications, while achieving a variety of negative technical impacts.
Mitigations
Leverage dedicated package managers instead of directly linking to VCS repositories.
Utilize version pinning and lock files to prevent use of maliciously modified repositories.
Implement vendoring (i.e., including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously.
Leverage automated tools, such as Checkmarx's ChainJacking tool, to determine susceptibility to Repo Jacking attacks.
Relationships with other CAPECs
CAPEC-616: Establish Rogue Location
Prerequisites
Identification of a popular repository that may be directly referenced in numerous software applications
A repository owner/maintainer who has recently changed their username or deleted their account
