GitHub repositories have become a crucial part of modern software development, allowing teams to collaborate, build, and deploy code. However, a critical vulnerability has been discovered in the way GitHub Actions artifacts are handled that poses a significant threat to the security of these repositories.
This attack vector can lead to high-level access to cloud environments, compromising sensitive data and potentially affecting millions of consumers. Many organizations, including some of the biggest in the world such as Red Hat, Google, AWS, Canonical (Ubuntu), Microsoft, OWASP and others, were discovered to be vulnerable to this attack.
GitHub Actions Artifacts Could Reveal Authentication Secrets
GitHub Actions workflows frequently use secrets to interact with cloud services and GitHub itself. These secrets include the ephemeral GITHUB_TOKEN, which is used to perform actions against the repository. However, when workflows are run, artifacts are generated and stored for up to 90 days. In open-source projects, these artifacts are publicly available for anyone to consume. Researchers from Unit 42 Palo Alto Networks found this to be a straightforward method for identifying potential security risks.
An automated process was created to download and scan artifacts from popular open-source projects, revealing working tokens for various cloud services and GitHub tokens. These tokens were not part of the repository code but were found in repository-produced artifacts. The most common mistake that led to the exposure of GitHub tokens was the default behavior of the actions/checkout GitHub action, which persists credentials and writes the GITHUB_TOKEN to the local git directory.
Another common mistake was the use of super-linter, a widely used open-source code linter, which logs environment variables, including GitHub tokens, in its log file. These logs are often uploaded as build artifacts, exposing sensitive tokens. The vulnerability had been disclosed to the maintainers of super-linter, with the issue receiving an official fix.
Abusing Leaked GitHub Tokens
While GITHUB_TOKENs are ephemeral and expire when the job ends, ACTIONS_RUNTIME_TOKENs, which are JWTs with a six-hour expiration, can be used to manage cache and artifacts. An automated process was created to download an artifact, extract the ACTIONS_RUNTIME_TOKEN, and use it to replace the artifact with a malicious one. Subsequent workflow jobs often rely on previously uploaded artifacts, creating a vulnerability to remote code execution (RCE) on the runner that runs the job consuming the malicious artifact.
The discovery of this vulnerability has led to a significant update in GitHub’s artifacts feature, allowing for the download of artifacts from the UI or API while the workflow run is in progress. This change has the potential to mitigate this threat, but it is essential for developers to be aware of the potential risks and take steps to secure their GitHub repositories.
The research focuses on the critical importance of maintaining a high level of credential hygiene in CI/CD environments, as in the case of GitHub’s deprecation of Artifacts V3. The researchers recommend reducing Github workflow permissions of runner tokens according to least privilege principles and regular review of the artifact creation in enterprise CI/CD pipelines.
Organizations can study the potential impact of insecure usage of GitHub Actions artifacts to take the necessary steps to secure their software development pipelines and protect their customers from the consequences of such vulnerabilities.
