.png)
5 hours ago
1
Sysdig researchers have warned that developers and maintainers could be leaving their repos open to hijacking through inadequately secured workflows on GitHub.
Researchers at the container and cloud native security firm highlighted potential abuse of the pull_request_target trigger event in GitHub Actions. Rather than pull_request, which “runs in the context of the merge commit, pull_request_target runs in the context of the base branch, typically the default branch.”
Moreover, they explain, “pull_request_target has access to secrets and write permissions for the GITHUB_TOKEN.” Maintainers often use the command to test changes in a pull request, “which usually involve untrusted code from public contributors’ forks.”
The problem is triggered workflows may have access to repo secrets, with the workflow’s GITHUB_TOKEN granted read and permissions by default. If a workflow is incorrectly configured, this could represent a “serious security risk.”
The researchers scanned dozens of repos and found numerous instances of such problematic workflows.
One example was uncovered on the Spotipy repo – an open source Python library for the Spotify Web API, used for making lightweight music applications. The researchers said it was possible to inject and execute a malicious Python package and exfiltrate the GITHUB_TOKEN and other secrets. The Spotify team have since fixed the flaw.
The researchers uncovered a similar flawed workflow in the Mitre cyber analytics repository, something they said was “hard to believe”. The researchers were able to exfiltrate the GITHUB_TOKEN and other secrets, “ultimately gaining elevated privileges within the repository”. Again, Mitre fixed the flaw quickly.
And they highlighted a “questionable” workflow in splunk/security_content, which allowed them to exfiltrate two secrets. In that case, they said, “the GITHUB_TOKEN extracted was well-scoped with just read content access”.
Stefan Chierici, threat research lead manager at Sysdig, said “What an attacker is able to do with pull_request_target depends on the GITHUB_TOKEN or other secrets they’re able to extract.”
If the token is highly privileged, an attacker could potentially “change existing workflows with malicious code, add new workflows to exfiltrate all the other secrets in the repository, and also modify any files within the main branch of the repository. In essence, this flaw gives them almost complete control over a compromised repository.”
He said that pull_request_target had nuances that “could easily confuse anyone” so it is crucial that maintainers fully understand it, and the security implications, and “use it with caution”. But, he added, there are “absolutely ways to use [it] safely.”
Chierici said the researchers had uncovered several vulnerable repos and would disclose other findings once reporting and remediation are complete.
