CVE-2025-23040: GitHub Desktop Credential Disclosure Flaw

CVE-2025-23040 Overview

CVE-2025-23040 is an Insufficiently Protected Credentials vulnerability (CWE-522) affecting GitHub Desktop, an open-source Electron-based GitHub application designed for git development. The vulnerability allows an attacker to exfiltrate user credentials by convincing the victim to clone a repository containing a maliciously crafted remote URL, either directly or through a submodule.

Critical Impact

Attackers can steal GitHub usernames, OAuth tokens, and credentials for other Git remote hosts stored in GitHub Desktop by exploiting the git-credential protocol misinterpretation.

Affected Products

• GitHub Desktop versions prior to 3.4.12
• All platforms running vulnerable GitHub Desktop versions (Windows, macOS)
• Environments using GitHub Desktop with stored Git credentials

Discovery Timeline

• January 15, 2025 - CVE-2025-23040 published to NVD
• January 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-23040

Vulnerability Analysis

This vulnerability exploits a flaw in how GitHub Desktop processes credential requests from Git during network operations. GitHub Desktop relies on Git to perform all network-related operations such as cloning, fetching, and pushing repositories. When a user attempts to clone a repository, GitHub Desktop invokes git clone, and when Git encounters a remote requiring authentication, it requests credentials for that remote host from GitHub Desktop using the git-credential protocol.

The core issue lies in the credential request parsing mechanism. When a maliciously crafted URL is processed, the credential request from Git can be misinterpreted by GitHub Desktop. This misinterpretation causes GitHub Desktop to transmit credentials intended for one host to a completely different, attacker-controlled host. The vulnerability requires local access and user interaction, as the victim must be convinced to clone a malicious repository.

Root Cause

The root cause of CVE-2025-23040 is improper validation and parsing of remote URLs within the git-credential protocol handler in GitHub Desktop. The application fails to properly sanitize and validate the host information extracted from credential requests, leading to a mismatch between the intended credential recipient and the actual destination. This is classified under CWE-522 (Insufficiently Protected Credentials), as the application does not adequately protect stored credentials from unauthorized disclosure.

Attack Vector

The attack requires local access with low privileges and user interaction. An attacker must craft a malicious repository with a specially formatted remote URL designed to exploit the credential parsing flaw. The attack chain proceeds as follows:

1. The attacker creates or modifies a repository with a maliciously crafted remote URL
2. The attacker convinces the victim to clone this repository (directly or as a submodule)
3. When GitHub Desktop processes the clone operation, Git requests credentials for the remote
4. The malformed URL causes GitHub Desktop to misinterpret the credential request
5. GitHub Desktop transmits the victim's credentials (GitHub OAuth token, username, or other stored credentials) to the attacker's server instead of the legitimate host

The attack can be particularly effective when delivered through a submodule, as users may not scrutinize submodule URLs as carefully as primary repository URLs. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-36mm-rh9q-cpqq.

Detection Methods for CVE-2025-23040

Indicators of Compromise

• Unexpected network connections to unknown hosts during Git clone operations
• Suspicious repository clone requests containing unusual or malformed URLs in Git logs
• OAuth token revocation alerts from GitHub indicating unauthorized access attempts
• Credential access logs showing GitHub Desktop sending credentials to unrecognized domains

Detection Strategies

• Monitor Git credential helper invocations for anomalous host patterns in the credential request
• Review GitHub audit logs for authentication events from unexpected IP addresses or locations
• Analyze network traffic from GitHub Desktop processes for connections to suspicious endpoints
• Implement endpoint detection rules to flag credential transmission to non-standard Git hosting services

Monitoring Recommendations

• Enable verbose logging for Git operations to capture credential protocol exchanges
• Configure SentinelOne to monitor process behavior for GitHub Desktop credential handling anomalies
• Set up alerts for GitHub OAuth token usage from unusual geographic locations or IP addresses
• Regularly audit authorized GitHub Apps and OAuth tokens for any unauthorized access

How to Mitigate CVE-2025-23040

Immediate Actions Required

• Update GitHub Desktop to version 3.4.12 or later immediately
• Revoke and regenerate GitHub OAuth tokens if you suspect credential compromise
• Review recently cloned repositories for suspicious remote URLs or submodules
• Audit GitHub account activity and authorized applications for unauthorized access

Patch Information

GitHub has released version 3.4.12 of GitHub Desktop which addresses this vulnerability. Users should update immediately through the application's built-in update mechanism or by downloading the latest version from the official GitHub Desktop website. For guidance on reviewing and revoking potentially compromised credentials, consult the GitHub Apps Authorization Review documentation.

Workarounds

• Avoid cloning repositories from untrusted sources until the update is applied
• Manually inspect remote URLs in .gitmodules files before cloning repositories with submodules
• Temporarily remove stored credentials from GitHub Desktop and use manual authentication
• Consider using Git from the command line with careful URL verification for sensitive operations

# Verify GitHub Desktop version
# On macOS/Linux, check About dialog or:
cat ~/Library/Application\ Support/GitHub\ Desktop/settings.json | grep version

# Revoke OAuth tokens via GitHub CLI
gh auth logout
gh auth login

# Clear stored credentials (if needed before update)
git credential-manager erase