Lightning Talk: Automatically Restrict Permissions for the GITHUB Token
summary
A January 2021 incident shows a command injection in a VS Code workflow exfiltrating the ephemeral GitHub Actions token which had contents write permission, allowing branch creation and merges. The solution is an open source tool, secure-workflows (github.com/step-security/secure-workflows), that scans workflows, uses a YAML knowledge base of action permissions, and rewrites files to set minimum token permissions and pins actions to commit sha. It has auto-fixed 1500+ workflows and remediated top-10 critical projects.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:21Agenda
- 0:51Title
- 1:08Demo
- 2:17GITHUB Token
- 2:43Permissions
- 3:51Manual Permissions
- 4:31Secure Workflows
- 4:54How it works
- 5:41How to use
- 6:13Impact
- 6:48Conclusion
related talks
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
56mHow to use GitHub Actions with Security in mind
57mGitHub Actions: A Cloudy Day for Security
15mGitHub Actions: a time bomb for supply chain security
23mBreaking the Build: How Attackers Abuse GitHub Actions
28mPwning the CI (with GitHub Action Workflows)
35mPwning the CI (GitHub Actions Edition)
43mGitHub Actions Best Practices