Executive Summary

Security researchers have disclosed a critical vulnerability in GitHub Copilot Chat, named 'CamoLeak', which could be exploited to silently exfiltrate sensitive data, including private source code and secrets, from a developer's environment. The attack, discovered by Legit Security, employed a sophisticated prompt injection technique hidden within pull requests. An attacker could embed malicious commands, invisible to the human eye, in markdown. When a victim used Copilot Chat to analyze the pull request, the AI would execute these commands, searching for and exfiltrating data the victim had access to. The exfiltration method was particularly novel, bypassing GitHub's Content Security Policy (CSP) by encoding the stolen data into a series of proxied image requests. GitHub has since mitigated the vulnerability by disabling the feature that enabled this covert channel. The flaw was assigned a 9.6 CVSS score by the researcher, highlighting its severity.

Vulnerability Details

The 'CamoLeak' attack is a form of indirect prompt injection. The core of the vulnerability lies in Copilot Chat's processing of all text within a given context, including text that is intentionally hidden from the user interface using markdown comments (<!-- -->).

The attack unfolds in these stages:

1. Injection: An attacker submits a pull request to a target repository. This PR contains malicious instructions for Copilot hidden inside markdown comments. These instructions tell the AI to find specific sensitive information (e.g., patterns matching API_KEY, _TOKEN, or other secrets) within the repositories accessible to the user reviewing the PR.
2. Execution: A developer or maintainer with access to private repositories uses Copilot Chat to review or summarize the malicious pull request. Copilot, running with the developer's permissions, ingests the entire text of the PR—including the hidden, malicious prompt.
3. Exfiltration: The malicious prompt instructs Copilot to exfiltrate the found secrets. To bypass security controls like CSP, the attacker uses a clever technique involving GitHub's image proxy, Camo. The attacker pre-generates a set of URLs pointing to 1x1 pixel images on their own server, each URL corresponding to a character (a 'pixel alphabet'). The prompt instructs Copilot to render the stolen secret as a sequence of these image URLs. The victim's browser then makes a request for each pixel to render the chat response, and the attacker reconstructs the secret by logging the sequence of incoming requests on their server.

Affected Systems

• Product: GitHub Copilot Chat
• Condition: The vulnerability affected users of GitHub Copilot Chat when reviewing or analyzing content from untrusted sources, such as pull requests from external contributors.

Exploitation Status

The vulnerability was responsibly disclosed to GitHub by Legit Security researcher Omer Mayraz. There is no evidence of this vulnerability being exploited in the wild. GitHub has implemented mitigations to prevent this attack vector.

Impact Assessment

Had this vulnerability been exploited, the impact could have been devastating. Attackers could have silently siphoned off proprietary source code, API keys, access tokens, unreleased vulnerability details, and other sensitive intellectual property from private repositories. The attack is particularly insidious because it leaves almost no trace in standard logs and requires no explicit malicious action from the victim other than using a trusted tool for its intended purpose. This could lead to severe supply chain attacks, financial loss, and breaches of customer data for organizations whose developers use Copilot.

Cyber Observables for Detection

Detection Methods

Detecting this specific attack vector post-mitigation is less critical, but detecting similar prompt injection attacks requires new approaches.

1. Content Scanning: Implement pre-commit hooks or CI/CD pipeline steps that scan incoming pull requests for suspicious markdown comments or prompts intended for AI assistants.
2. Network Anomaly Detection: Monitor for unusual patterns of outbound HTTP requests from developer environments, especially during code review activities. A sudden burst of requests to an image hosting domain could be an indicator of this type of exfiltration.
3. Endpoint Monitoring: While difficult, EDR tools could potentially be configured to alert on processes related to IDEs or browsers making rapid, sequential, and similar network requests, which might indicate a character-by-character exfiltration attempt.

Remediation Steps

GitHub has already remediated the specific 'CamoLeak' vector by:

1. Disabling Image Rendering: Images are no longer rendered within the GitHub Copilot Chat interface, breaking the 'pixel alphabet' exfiltration channel.
2. Blocking Camo Misuse: GitHub blocked the specific functionality of Camo that allowed it to be used as a covert channel for exfiltrating user content.

For developers and organizations, the key mitigation is awareness and process hardening:

• User Training: Educate developers about the risks of prompt injection in AI-powered tools. This is a D3FEND User Account Permissions (related) control, as it's about how users interact with powerful tools.
• Restrict AI Tool Permissions: Where possible, run AI assistants in a more sandboxed environment with limited access to sensitive files until the technology matures. This aligns with D3FEND's Application Isolation and Sandboxing principles.