GitBook released an incident recap report on November 4. On November 2, attackers exploited a vulnerability in the SSO login process to forge employee sessions, obtained internal code repository and Cloudflare API keys through a misconfigured GitHub App, and subsequently accessed production environment keys and gained infrastructure privileges.
The timeline shows that at 00:32 on November 3, employee sessions and source code were obtained; at 01:48, the system entered the production environment; at 03:58, the SSO vulnerability was fixed; at 04:32, the account was isolated and the application was taken offline; at 11:56 on November 3, the key rotation was completed and the service was restored, with an downtime of approximately 16 hours.
During their access to the production environment, the attackers had access to GitBook API tokens, integration tokens and keys, session signing keys, authenticated access to the documentation site, GitHub and GitLab repositories, and customer content. Billing information, passwords, and IP addresses were not compromised, and no evidence of modification of customer content was found.
The investigation points to a targeted attack against a single customer. GitBook has already taken measures to address the issue, including exposing all customer data, rotating all infrastructure and customer keys, and invalidating old API tokens. The report claims the attack was driven by an AI agent. The report was authored by CEO Sara Tandowsky and co-founder and CTO Samy Pessé.
