GHSA-jwcm-9g39-pmcw Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts

• Go github.com/cli/cli/v2: < 2.63.0 → fixed in 2.63.0

Summary A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. Details This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, `gh pr checkout`. These GitHub CLI commands invoke `git` with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: • `GITHUB_ENTERPRISE_TOKEN` • `GH_ENTERPRISE_TOKEN` • `GITHUB_TOKEN` _when `CODESPACES` environment variable is set_ The result being `git` sending authentication tokens when cloning submodules. In `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Impact Successful exploitation could lead to a third-party using leaked authentication tokens to access privileged resources. Remediation and mitigation 1. Upgrade `gh` to `2.63.0` 2. Revoke authentication tokens used with the GitHub CLI: • Personal access tokens • GitHub CLI OAuth app 3. Review your personal security log and any relevant audit logs for actions associated with your account or enterprise