5 ms·
Yes, this has been an issue for so long and GitHub just doesn't care enough to fix it. There's another way it can be exploited. It's very common to pin Actions
by cedws 7mo ago
Yes, this has been an issue for so long and GitHub just doesn't care enough to fix it.
There's another way it can be exploited. It's very common to pin Actions in workflows these days by their commit hash like this:
- uses: actions/checkout@378343a27a77b2cfc354f4e84b1b4b29b34f08c2
But this commit doesn't even have to belong to the preceding repository. You can reference a commit on a fork. Great way to sneak in an xz-utils style backdoor into critical CI workflows.
GitHub just doesn't care about security. Actions is a security disaster and has been for over a decade. They would rather spend years migrating to Azure for no reason and have multiple outages a week than do anything anybody cares about.
- gfody 7mo agoyikes.. there should be the cli equivalent of that warning banner at the very least. combine this with something like gitc0ffee and it's downright dangerous
- WorldMaker 7mo agoA YAML linter for it, too. I was appreciating the cron input overlay in the current GitHub Actions VS Code extension. In ghost text beside a cron: 'something' input it gives you a human-readable description. Seems like it could also do a similar thing for actions commit refs, show a simple verification if it corresponds to a tag or not in that repo.
- tomjakubowski 7mo ago> But this commit doesn't even have to belong to the preceding repository. You can reference a commit on a fork. Great way to sneak in an xz-utils style backdoor into critical CI workflows. Wow. Does the SHA need to belong to a fork of the repo? Or is GitHub just exposing all (public?) repo commits as a giant content-addressable store?
- sheept 7mo agoNeeds to be a fork. Related: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github https://trufflesecurity.com/blog/anyone-can-access-deleted-a...
- PunchyHamster 7mo agoIt appears that under their system all forks belong to same repo (I imagine they just make _fork/<forkname> ref under git when there is something forked off main repo) presumably to save on storage. And so accessing a single commit doesn't really care about origin(as finding to which branch(es) commit belongs would be a lot of work)
- varenc 7mo agoThis trick is also useful for finding code that taken down via DMCA requests! If you have specific commits, you can often still recovery it.