-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ossf/allstar | go | < 0.0.0-20250721181116-e004ecb540d6 | 0.0.0-20250721181116-e004ecb540d6 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability exists in the reviewbot component of the Allstar application, which was entirely removed to mitigate the issue. The root cause is an authentication bypass due to a hard-coded secret token, "FooBar", used for validating GitHub webhook signatures. The function reviewbot.WebookHandler.HandleRoot in pkg/reviewbot/reviewbot.go is the direct location of the vulnerability, as it uses this hard-coded value when calling github.ValidatePayload. This flaw allows an attacker with knowledge of the public, hard-coded secret to craft a malicious webhook that the application will treat as authentic. Successful exploitation would lead to the execution of the reviewbot.runPRCheck function, which could allow an attacker to manipulate repository pull requests by triggering automated reviews or checks. The main.main function in cmd/reviewbot/main.go serves as the entry point for this vulnerable service, initiating the webhook listener via reviewbot.HandleWebhooks. Therefore, any of these functions appearing in a runtime profile would indicate that the vulnerable component is active and potentially being exploited.
reviewbot.WebookHandler.HandleRootpkg/reviewbot/reviewbot.go
reviewbot.runPRCheckpkg/reviewbot/checks.go
main.maincmd/reviewbot/main.go
reviewbot.HandleWebhookspkg/reviewbot/reviewbot.go
Ongoing coverage of React2Shell