Hugging Face Hub Repository Takeover via Flawed Secret Scanning Remediation
Overview
A critical vulnerability was discovered in the Hugging Face Hub's secret scanning mechanism, which could allow a malicious user to take over other users' repositories. The vulnerability, identified as CVE-2023-49785, was related to how the platform handled pull requests containing what appeared to be Hugging Face access tokens. The platform's security scanner would automatically invalidate any token it found in a public repository to prevent leaks. However, an attacker could exploit this by creating a pull request to a target repository and including their *own* valid access token in the PR's content. The scanner would detect this token and, in a flawed attempt to remediate, would not only invalidate the attacker's token but also grant the attacker's account write permissions to the target repository. This effectively allowed a complete takeover. An attacker could then modify the repository's code, poison model weights, or delete the repository entirely. The issue stemmed from a logical flaw in the automated security remediation process, which incorrectly assigned ownership or permissions based on the author of the pull request containing the detected secret. This vulnerability posed a significant threat to the integrity of the AI supply chain, as countless popular models and datasets hosted on the Hub could have been maliciously altered.
Affected Systems
Testing Guide
1. **This vulnerability cannot be tested by users** as it was a server-side logic flaw that has been patched by Hugging Face. 2. **To verify your repository's security,** navigate to your repository settings on the Hugging Face Hub. 3. Go to the 'Collaborators and teams' section and ensure that only trusted accounts have 'write' or 'admin' permissions. 4. Review the pull request history for any strange or unsolicited PRs from the time before the patch (prior to December 2023).
Mitigation Steps
1. **No User Action Required (Platform Patched):** This vulnerability was in the Hugging Face platform itself and has been fixed by their team. Users do not need to take any action to patch their own systems. 2. **Review Repository Access:** As a general best practice, regularly review who has write access to your critical repositories on Hugging Face Hub. Remove any unrecognized or unnecessary collaborators. 3. **Enable Protected Branches:** Where possible, use branch protection rules to prevent direct pushes to main branches, requiring pull request reviews before merging changes. 4. **Monitor for Suspicious Activity:** Keep an eye on your repository's commit history and pull requests for any unauthorized or suspicious contributions.
Patch Details
The vulnerability was patched by Hugging Face on the platform side. The flawed remediation logic that granted permissions was corrected.