Github Actions Security Landscape
summary
Research finds widespread misuses that let untrusted issue titles execute shell on runners and steal tokens. Using ngrok + netcat the exploit opens a reverse shell, lists env vars and reads .git/config to recover the ephemeral GITHUB_TOKEN. Scans hit thousands of repos including popular projects. Attackers commit a new workflow that exfiltrates org and repo secrets then self deletes. Fixes shown: sanitize inputs, restrict token permissions and use environments.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:14How a Github Action Workflow Looks
- 4:21Github Runner
- 5:22What Is Github Token
- 6:04Github Token
- 11:36The Github Code Search
- 22:15Commit a Malicious Code to the Repository
- 28:52Sanitizing Your Input
- 29:40Limit Token Permissions
- 30:34Organization Secrets
- 30:52Environments and Branch Protection
- 31:29Takeaways
related talks
57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measures
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
23mBreaking the Build: How Attackers Abuse GitHub Actions
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
28mPwning the CI (with GitHub Action Workflows)
51mSecuring the Pipeline: Protecting Self-Hosted GitHub Runners