Description

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-20T20:17:46.190Z",
  "pubdate": "2026-08-20T20:17:46.190Z",
  "executiveSummary": "An authentication bypass vulnerability exists within the github-issue-bot templates provided in appwrite/templates. The vulnerability specifically affects the webhook signature verification logic implemented in node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts. Due to an inverted logical condition involving the X-Hub-Signature-256 header, the verification function evaluates to true when the signature is entirely absent, causing the logical OR operator to short-circuit and bypass cryptographic HMAC validation.\nConsequently, main.js accepts unauthenticated webhook requests without enforcing cryptographic verification. Attackers can exploit this flaw to interact with the deployed function anonymously. Once bypassed, the processing logic proceeds to postComment, which utilizes the repository and issue objects directly from the untrusted request body. An attacker can leverage the configured GITHUB_TOKEN to force the deployment to post comments on arbitrary repositories and issues while injecting attacker-controlled issue author login strings directly into the comment text. This introduces severe risks of unauthorized resource manipulation and automated comment abuse across affected GitHub integrations.",
  "technicalDetails": "The root cause of the vulnerability resides in the flawed implementation of the verifyWebhook function located in node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts. The function evaluates the condition as typeof signature !== 'string' || (await verify(...)). When an incoming request lacks the X-Hub-Signature-256 header entirely, the first operand (typeof signature !== 'string') evaluates to true. Because of this evaluation, the logical OR short-circuits, completely bypassing the asynchronous cryptographic HMAC verification step that follows.\nThe main.js entry point relies on the boolean return value of verifyWebhook, rejecting incoming requests only when the function explicitly returns false. Because the signature check improperly passes upon receiving requests without any signature header, unauthenticated requests successfully bypass this security gate. Following this bypass, execution flow advances to the postComment function.\nThe postComment function extracts repository and issue objects directly from the unverified request body without performing schema validation or sanitization. This permits an external attacker to supply arbitrary target parameters, directing the deployed function to interact with any repository and issue of their choosing. Furthermore, the issue author login value extracted from the request body is directly interpolated into the generated comment text, enabling arbitrary message insertion.\nExploitation requires network exposure to the deployed webhook endpoint. The attacker needs no prior authentication, valid cryptographic secrets, or privileges, as the lack of a signature header successfully satisfies the flawed conditional check. Upon successful exploitation, the attacker achieves unauthorized execution capabilities, utilizing the elevated permissions of the configured GITHUB_TOKEN to perform unauthorized actions against target GitHub repositories."
}