Contents: Write

Techniques it enables

• Push directly, without review Submit malicious code
• Push more commits after approval Submit malicious code
• Approve someone else's PR, then push to it Submit malicious code
• Hide it in a change nobody can review Submit malicious code
• Use a trusted colleague's account Submit malicious code
• Force push or delete a protected branch Delete code or cover tracks
• Delete branches and workflow runs Delete code or cover tracks
• Push a release tag to an unreviewed commit Point a release tag at a bad commit
• Repoint existing tags on a published Action Point a release tag at a bad commit
• Run PR code in a privileged workflow Steal CI secrets and tokens
• Read secrets from the runner Steal CI secrets and tokens
• Trigger the publish workflow from a tampered branch Poison the build or published package

Escalations it starts

• Move release tags on a widely used Action: Code execution, with their secrets, in every repository that pins the Action by tag.
• Change a shared reusable workflow: Code running in every calling repository's workflow, with the secrets and GITHUB_TOKEN those runs get: an internal version of a compromised Action.

Reached through

• Add a collaborator or guest that outlives the attack · from Members: Write (org) or Administration: Write
• Take the workflow token from a runner · from Code already running in a workflow job: a compromised Action, dependency or pull request
• Persist on a non-ephemeral self-hosted runner · from A pull request from a fork that runs on a self-hosted runner that is not wiped between jobs

Abused in

Fixed or limited by

• Enforce MFA for every member (prefer hardware/FIDO2 keys over SMS or app codes)
• Enable audit logging and export it to a SIEM for retention and detection
• Branch protection on default/release branches: required reviews + required status checks
• Dependency graph, Dependabot alerts and Dependabot security updates enabled
• Deletion and force-pushes prevented on critical branches
• CODEOWNERS in place, required on sensitive paths
• Rulesets applied: push restriction, tag protection, sensitive file-path protection
• Require signed commits on the default branch of sensitive repos
• Set the default GITHUB_TOKEN permission to read-only at the org level
• Require approval for first-time/external contributor workflow runs on forks
• Third-party Actions pinned to a full commit SHA instead of a mutable tag or branch
• Audit every use of pull_request_target and remove or restructure risky ones
• Restrict which Actions can run to GitHub-verified creators or an internal allow-list