# Use Github pack with Coda employee github account (search code of Coda's private repositories)

Unauthenticated Coda InvokeFormula endpoint accepted any public document's GitHub connection id, letting an attacker run CodeSearch against a Coda employee's private repos.

- Payout: hidden
- Severity: medium
- Program: Superhuman (formerly Grammarly)
- Found by: stefanovettorazzi
- Disclosed: 2020-01-02
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/676581
- Library page: https://bugbountylibrary.com/r/h1%3A676581
- Tags: area:web3 domain:api impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:grpc technique:recon vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Coda gRPC endpoint /coda.CalcService/InvokeFormula and GitHub pack CodeSearch formula
**Root cause:** InvokeFormula trusts a document id plus connection id supplied in the request body without verifying the caller owns or is authorized for that connection, and the endpoint requires no authentication.
**Steps:**
1. Sign in to coda.io and open https://coda.io/t/Git-Cherry-Pick-From-Branch_tTZJuuyHgqa/preview?useBack
2. In Burp, note the iframe request to `https://coda.io/embed/igvicDMruo?viewMode=gallery&disconnected=true`; document id is `igvicDMruo`
3. GET `https://coda.io/internalAppApi/documents/igvicDMruo/externalConnections` and read the `id` of the object named `albertc44` (`7b167155-731e-4913-9091-729c5bd77ee0`)
4. Create a new doc, add the GitHub pack, sign in and authorize, then insert a Github CodeSearch formula with args `, "secret", organization: "kr-project"`
5. Capture the `/coda.CalcService/InvokeFormula` request in Burp
6. Remove the `Cookie` header; replace the value between `$` and `2$` with the stolen connection id
7. Replace the first ten characters of the last line (document id) with `igvicDMruo`
8. Send the request; read results from the `Fragment` values in the response
**How found:** Noticed the InvokeFormula request body carried both a document id and a connection id, hypothesized these were not bound to the caller, and tested by swapping in ids from a public Coda employee document while stripping cookies.
**Exploitation:** Attacker harvests a victim document id and connection id from any public/shared Coda doc via the externalConnections API, then replays them in an unauthenticated InvokeFormula gRPC call to execute GitHub CodeSearch under the victim's GitHub authorization, exfiltrating private repo code search results.
**Insight:** When a backend RPC takes both a resource id and a credential/connection id from the client, try mixing ids across tenants/documents and dropping auth headers — the server may only validate the id format, not ownership.