Runner registration token or JIT configuration
Why Tier 1
Registers a machine as a self-hosted runner. That machine then receives the jobs routed to its labels and the secrets those jobs get, so it is the same reach as Self-hosted runners: write.
A short-lived credential (a registration token expires after one hour) or a just-in-time runner configuration, used to add a self-hosted runner to a repository or organization.
Available on: Every setup. Source
Attack path
A registration token or JIT configuration copied from a build log, a script or a provisioning pipeline lets an attacker register their own machine under the expected labels. Jobs then run on it, with their secrets and GITHUB_TOKEN, until someone notices the extra runner.
Mitigations
- Create registration tokens just before use and never log them
- Use runner groups limited to the repositories that need them
- Alert on new self-hosted runners
Detect
Alert on org.register_self_hosted_runner, org.configure_self_hosted_jit_runner, repo.register_self_hosted_runner, enterprise.register_self_hosted_runner in the audit log.