GitHub Security Lab

Yeah, I think that documentation is irresponsibly misleading: it implies that (1) attacker code execution requires the attacker to be able to run code directly (it doesn't, per this post), and (2) that checking out at the base branch somehow stymies the attacker, when all it does is incentivizes people to check out the attacker-controlled branch explicitly. GitHub has written a series of blog posts[1] over the years about "pwn requests," which do a great job of explaining the problem. But the misleading documentation persists, and has led to a lot of user confusion where maintainers mistakenly believe that any use of `pull_request_target` is somehow more secure than `pull_request`, when the exact opposite is true. [1]: https://securitylab.github.com/resources/github-actions-preventing-pwn…

This work comes from GitHub's Security Lab https://securitylab.github.com/

Github badly need to add an abstraction for passing an artifact between workflows. The official recommendation for how to use workflow_run is comically messy (20+ lines of javascript-in-yaml because actions/download-artifact doesn't support fetching artifacts across repos): https://securitylab.github.com/research/github-actions-preventing-pwn-… Kinda hard to expect average users to grok this, running a follow-up workflow in a secure context with some carried over artifacts should be trivial to do declaratively.

The normal thing is to have integration test PRs and other CI actions (which may require access tokens to APIs, inherently or due to naive design) be defined by the incoming branch, creating a vector for an attacker to get access to privileged resources. For certain parts of integration and testing jobs that are operating on untrusted code, it'd therefore be desired to not allow incoming PRs to change certain parts of the CI configuration (not only including .github/workflows, which can be protected using branch protection rules, but the testing framework). It's possible to achieve this by splitting up your workflows and using workflow_run but it's non-obvious and finicky enough that I very rarely see it done. GitHub could make this easier and propose better patterns than they do in their attempt to address the problem[0], which I think could use a 2023 follow-up. [0]: https://securitylab.github.com/research/github-actions-preventing-pwn-… --- In this context, an iMessage message <> a GitHub PR, I guess.

…And at this point probably not one but two 9s (or possibly more) of security vulnerabilities [1] [1] https://securitylab.github.com/resources/github-actions-preventing-pwn…

Related work from our security lab: Stream of vulnerabilities discovered using security agents (23 so far this year): https://securitylab.github.com/ai-agents/ Taskflow harness to run (on your own terms): https://github.blog/security/how-to-scan-for-vulnerabilities-with-gith…

The workflows were set up to execute with a read/write `GITHUB_TOKEN` for `nx` when a PR was created/edited (no approval necessary). See the security warnings on `pull_request_target` https://docs.github.com/en/actions/reference/workflows-and-actions/eve… https://securitylab.github.com/resources/github-actions-preventing-pwn…

`pull_request_target` (which has access to secrets) runs in the context of the destination branch, so any malicious workflow would need to have already been committed. GitHub has a page on this: https://securitylab.github.com/resources/github-actions-preventing-pwn…

It is interesting to see a GitHub employee (team) working on Android vulnerability. Is it Google's Project Zero-like pure research? His writing is interesting anyways. Until I read this one [1] I didn't even know Snapdragon NPU has an open source driver. It's scary to see such a complex logic like NN graph execution running in the kernel space. * [1] https://securitylab.github.com/research/qualcomm_npu/

There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples: https://www.hackerone.com/internet-bug-bounty https://huntr.dev/ https://securitylab.github.com/bounties/ https://www.mozilla.org/en-US/security/bug-bounty/

Oof on the terms & conditions: https://securitylab.github.com/tools/codeql/license/

While I agree with most of what you are saying (let's hope that 2021 will finally be "the year of memory-safe languages"), remote code execution issues also affect Java. https://securitylab.github.com/research/securing-the-fight-against-cov… is just one of the latest prominent examples.

GitHub will pay you to write new rules for this. https://securitylab.github.com/bounties

I'm still pretty impressed by dev-targetted malware like this: https://securitylab.github.com/research/octopus-scanner-malware-open-s…

The fundamental mistake here seems to have been not fully understanding the threat model of the pull_request_target action trigger. pull_request_target jobs run in response to various events related to a pull request opened against your repo from a fork (e.g, someone opens a new PR or updates an existing one). Unlike pull_request jobs, which are read-only by default, pull_request_target jobs have read/write permissions. The broader permissions of pull_request_target are supposed to be mitigated by the fact that pull_request_target jobs run in a checkout of your current default branch rather than on a checkout of the opened PR. For example, if someone opens a PR from some branch, pull_request_target runs on `main`, not on the new branch. The compromised action, however, checked out the source code of the PR to run a benchmark task, which resulted in running malicious attacker-controlled code in a context that had sensitive credentials. The GHA docs warn about this risk specifically: > Running untrusted code on the pull_request_target trigger may lead to security vulnerabilities. These vulnerabilities include cache poisoning and granting unintended access to write privileges or secrets. They also further link to a post from 2021 about this specific problem: https://securitylab.github.com/resources/github-actions-preventing-pwn… That post opens with: > TL;DR: Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR is a…

> If my repo always runs all tests on a PR, could someone just add a PR with a new test that is then run? Thus running their arbitrary code. Running arbitrary code is inevitable if an action is configured to run on all PRs. People have abused this to run crypto miners and stuff in the past, but this for the most part is merely an annoyance to maintainers, not a security problem. It does become a security problem when arbitrary code execution is allowed with your secrets, including your configured secrets and the read/write GITHUB_TOKEN. Expanding on the topic of secrets, if you trigger your test from the usual pull_request event, the workflow won't have access to GITHUB_TOKEN or configured secrets, so it's the safe default you should almost always choose. That becomes a problem when you need write access to the repo, e.g. to assign labels or add comments to the PR from the workflow, in which case you have to use the privileged pull_request_target event to expose GITHUB_TOKEN and secrets. pull_request_target by default runs in the context of the base of the PR, so there's still no arbitrary code, but you can explicitly check out the PR in that context, and when you do, your secrets are potentially exposed to arbitrary code. If you execute that arbitrary code in any job, or like in this case, post the content of effectively any file on disk as directed by an attacker, boom, owned. Therefore, you should - Avoid pull_request_target unless white access to the repo and/or…