Hacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?

### Overview In this presentation, Steve Giguere shares research conducted alongside Avi Greenholtz exploring supply chain vulnerabilities within GitHub Actions and open-source workflows. Expanding upon initial research into command injection, npm email hijacking, and repo jacking, the talk demonstrates how attackers can chain vulnerabilities across GitHub Action dependencies to build a self-propagating CI/CD "worm" capable of compromising upstream actions and moving downstream to harvest sensitive secrets.

### Key Topics - **GitHub Actions Attack Vectors**: Core repository risks include command injection, npm email hijacking, dependency confusion, and repo jacking. - **Repo Jacking in GitHub Actions**: Unlike standard repositories protected by GitHub's retirement threshold (100 clones prior to account rename/deletion), GitHub Actions download assets instead of cloning. This leaves moved or deleted action namespaces vulnerable to re-registration and takeover. - **Poison Pipeline Execution & Default Configurations**: Prior to March 2023, the default `GITHUB_TOKEN` had read/write permissions. Combined with default settings allowing first-time contributors' PR workflows to run without explicit approvals, attackers could execute arbitrary workflows, approve pull requests, and exfiltrate secrets. - **Upstream Action Dependency Mapping**: By constructing a Neo4j dependency graph of actions using other actions across popular repositories, researchers traced multi-tier downstream attack paths.

### Technical Details - **Command Injection via Metadata**: Workflows that directly interpolate issue titles or other untrusted metadata into bash commands or runner steps allow arbitrary shell execution. - **Runner Persistence and Privilege Escalation**: In demonstrations on GitHub-hosted and self-hosted runners, the speaker established a reverse shell via `netcat`, modified git configurations to spoof commits as other contributors (e.g., Linus Torvalds), closed PRs to circumvent workflow timeouts, and leveraged standard Docker access to escalate privileges to root. - **Large-Scale Analysis**: Analyzing the top 10,000 GitHub repositories by stars alongside 32,000 repositories belonging to companies with bug bounty programs, the team isolated approximately 7,000 repositories using GitHub Actions. From this dataset, 175 repositories were directly vulnerable without chaining. In one chain, compromising a single initial repository allowed compromising 18 intermediary actions and stealing secrets from 72 downstream targets. Another path involving Veracode and Hangfire exposed a NuGet package with nearly 10,000 daily downloads, ultimately exposing nearly 12,000 repositories. - **The Tag-Overwriting Worm**: Because actions are commonly referenced by mutable tags (e.g., `v1`) rather than immutable commit SHAs, compromising a read/write token enables pushing malicious updates and overwriting release tags with force commits. When downstream repositories run workflows calling that tag, the malicious payload repeats the process, propagating downstream.

### Takeaways & Mitigations - **Token Permissions**: Set `GITHUB_TOKEN` and personal access tokens to read-only by default and strictly enforce minimal permissions. - **Tag Pinning**: Pin all GitHub Actions to full commit SHAs instead of mutable tags. The speaker recommends using the open-source tool `ghat` by James Woolner to automate this. - **Branch & Tag Protection**: Enable branch protection and enforce protected tags to prevent unauthorized tag overwrites and force pushes. - **Contributor Approvals & CODEOWNERS**: Configure repositories to require approval for workflows submitted by outside contributors, and use `CODEOWNERS` to restrict workflow modifications. - **Runner Hardening**: Never use self-hosted runners for public open-source projects, and restrict outbound network connections from runners to trusted domains.