GitHub Actions is improperly configured, which may lead to hijacking of code repository and leaking confidential information – Passionategeekz

Passionategeekz On June 19, a research team from cloud-native security company Sysdig found that developers and warehouse maintainers configured GitHub Actions incorrectly.The risk of hijacking of code repositories and leaking confidential information.

Passionategeekz cited Wu Dan to introduce, and the team pointed out that the core problem originated from the right pull_request_target Triggering abuse of events. Unlike the regular pull_request event, pull_request_target runs in the main branch context of the repository, rather than the merged commit environment.

This means it can access the repository’s sensitive secrets (such as API keys) and GITHUB_TOKEN’s default read and write permissions. If the developer does not restrict permissions, an attacker may steal tokens and control the repository through malicious code injection.

After scanning dozens of open source repositories, researchers found multiple high-risk cases:

• Spotipy library: In Spotify’s open source Python library, Spotipy, an attacker can inject malicious Python packages to steal GITHUB_TOKEN and other confidential information. The Spotify team has fixed the vulnerability.

• Mitre Repository: A similar vulnerability exists in the repository of the cybersecurity analysis tool Mitre, and researchers successfully steal tokens and increase permissions, and Mitre quickly patched the problem.

• Splunk Security Content: In another case, an attacker could leak two confidential pieces of information from Splunk’s security_content repository, which exposed configuration flaws despite limited permissions (read only).

Stefan Chierici, director of threat research at Sysdig, pointed out that if an attacker can extract high-authorized GITHUB_TOKEN, he can tamper with workflow code, steal all secrets, and even modify the main branch file, and almost complete control of the repository.

He stressed that the use of pull_request_target is complex, and developers need to fully understand its security risks and avoid “blind dependence”. Although this feature is safe to use, it is recommended to enable it only if necessary and strictly restrict access.

Advertising statement: The external redirect links (including, not limited to, hyperlinks, QR codes, passwords, etc.) contained in the article are used to convey more information and save selection time. The results are for reference only. All articles from Passionategeekz include this statement.