Breaking GitHub Private Pages for $35k

I found and reported this vulnerability with @ginkoid. This was actually the first report that paid out for me on HackerOne. At $35,000, it’s also the highest bounty I’ve received so far from HackerOne (and I believe the highest GitHub has paid out to date). A lot of bugs seem to be a mix of both luck and intuition. In this blog post, I’ll illustrate my thought processes in approaching such a targ

[efcl]

GitHubのPrivate Pagesは`*.pages.github.io`というサブドメインを使うが、`pages.github.io`はPublic Suffix Listにないため、 Same Siteとして扱われて`document.cookie`でCookieを設定できてしまう問題などを使ったPrivate Pagesを読み取る脆弱性