Abuse of GitHub Codespaces may Turn it into Malware Distribution Center

A brief about GitHub Codespaces

• It was rolled out for the public in November of last year, and all personal accounts on GitHub have a monthly quota for free use of GitHub Codespaces.
• The platform allows developers to share their work with external users by means of TCP port forwarding for testing purposes.

But there’s a catch!

• When the post is kept private, external users are required to authenticate by means of a token or cookies to access the URL.
• However, public ports are accessible to everyone, and no authentication is required. 
• Researchers were able to demonstrate that this feature can be abused by attackers to host malicious content on the platform.

Serving malware via GitHub Codespaces

• An attacker can run a simple Python web server, host malicious code or malware on their Codespace, and expose the web port for public visibility. 
• The URL generated for accessing this public repo can be used to access the malicious code without the need for any authentication. Thus, the malware can be downloaded easily, without raising any security flags. 
• Moreover, the use of Dev Containers (full-featured development environments) makes it possible to distribute malicious content much faster and more efficiently. 

Concluding notes