Connect with us
ANE Scholarship
Categories:
X

Technology

GitHub Actions workflow flaws gave applications like Logstash write access

Published

on

GitHub Actions workflow flaws gave applications like Logstash write access
Share this post:

Malicious builds and wider infrastructural compromise were worst-case scenarios.

Security researchers have identified multiple workflows in popular continuous integration and development (CI/CD) service GitHub Actions that are vulnerable to command execution.

A research team from dating platform Tinder crafted an automation script that unearthed flaws that enabled the exfiltration of secrets that provide write access to various open source GitHub repositories, including Elastic’s Logstash.

A blog post documenting the findings was penned by Rojan Rijal, Johnny Nipper, and Tanner Emek – respectively red teamer, senior product security manager, and engineering manager at Tinder.

The trio told Daily Swig that “in the worst case scenario, you can exploit a vulnerable workflow to retrieve the GITHUB_TOKEN value”, which has read/write access to the repository by default. “This can be used to push a malicious build against users and perform supply chain related exploits.”

If more sensitive access secrets within the workflow such as AWS credentials, API Keys, or service credentials were exposed, “this could lead to a compromise of a company’s infrastructure”, they added.

The most common cause of vulnerabilities was unsafe user inputs in run scripts. The researchers also found many examples where pull_request_target was misused, which among other things could bypass a 2019 fix for an issue related to the use of event handlers in forked repositories.

The research focused on projects with vulnerability disclosure policies, with validated vulnerabilities responsibly reported to projects. Elastic’s security team quickly deactivated the vulnerable workflow and confirmed no abuse had occurred, said the researchers.

GitHub Workflow Auditor

Tinder Security Labs has open sourced the tool used for the research. GitHub Workflow Auditor checks workflows for unsafe user inputs, malicious commits, and secrets.

Given the limitations of comparable, existing tools, the authors told Daily Swig that they “focused on covering most vulnerability cases in GitHub Actions as well as efficiency. As such, we allow organizations to scan all of their repositories at once by providing a GitHub API key. This reduces time and effort for security teams”.

The tool also addressed a supply chain risk posed by workflows running actions from old GitHub accounts. “In such cases, attackers can claim the account and push malicious actions allowing them to get access to the repository and its workflows,” the researchers explained. “This specific case was not covered by the tools that we tested.”

They added: “Our goal at Tinder Labs is to identify high impact vulnerabilities in a wide array of technologies which have global impact. As we research other technologies, you can expect to see more findings and tools from us in the future.”

Mitigations

The researchers urged developers to properly sanitize user inputs in GitHub Actions and mitigate attacks by limiting GitHub Tokens’ access scope.

GitHub Security Lab has, meanwhile, previously recommended that pull_request_target only be used when developers “need the privileged context of the target repo” in their workflow.

Tinder Security Labs’ findings follow the disclosure in March of misconfigured GitHub Actions workflows that caused critical flaws in dozens of repos, and a GitHub Actions patch in January for a code review safeguard bypass.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Erik Ten Hag Manchester United vs Brighton
Sports2 hours ago

Erik Ten Hag Chops First Breakfast as Man Utd Manager as Brighton Wins 2-1

Ronaldo
Sports3 hours ago

Man Utd must let Ronaldo leave – Wayne Rooney

Scholarship Graduate
Education3 hours ago

Australia Scholarship: Apply for Griffith University degree scholarship, 2022

Godwin Obaseki
Education3 hours ago

Edo Govt To Recruit 1000 New Teachers, Train 650 Others

Airport
News3 hours ago

Ebonyi Govt Laments Destruction Of Airport Fence

Isco
Sports3 hours ago

Transfer: Real Madrid star, Isco to Sevilla as free agent

Neto
Sports3 hours ago

Transfer: Neto joins Bournemouth from Barcelona

Kano loses one pilgrim in Saudi Arabia
News5 hours ago

Kano loses one pilgrim in Saudi Arabia

Tobi Amusan wins a gold medal at the Commonwealth Games and breaks a record
Sports6 hours ago

Tobi Amusan wins a gold medal at the Commonwealth Games and breaks a record

News6 hours ago

Deposed Emir Sanusi: “I’ll keep speaking out to rebuild Nigeria.”

Religious organizations disagree on how to pay for the Jos Main Market project
News6 hours ago

Religious organizations disagree on how to pay for the Jos Main Market project

Jenkins security: The most recent plugin advisory contains flaws with unpatched XSS and CSRF
Technology6 hours ago

Jenkins security: The most recent plugin advisory contains flaws with unpatched XSS and CSRF

ParseThru: Multiple Go apps have been found to have an HTTP parameter smuggling issue
Technology6 hours ago

ParseThru: Multiple Go apps have been found to have an HTTP parameter smuggling issue

Director of Batgirl reveals After the movie was canceled, Marvel CEO Kevin Feige contacted him
Entertainment7 hours ago

Director of Batgirl reveals After the movie was canceled, Marvel CEO Kevin Feige contacted him

Our pop queen dreams have come true with the epic Break My Soul and Vogue remix by Beyonce and Madonna
Entertainment7 hours ago

Our pop queen dreams have come true with the epic Break My Soul and Vogue remix by Beyonce and Madonna

Buhari
News7 hours ago

Buhari condemns killings of Nigeriens and police officials in South East

News7 hours ago

In Ekiti, gunmen abduct a 4-year-old boy while the father runs

News7 hours ago

NDA changes the curriculum to better train cadets for asymmetrical warfare

In Everton's tight loss to Chelsea, Alex Iwobi shines for the team
Sports8 hours ago

In Everton’s tight loss to Chelsea, Alex Iwobi shines for the team

Following a 4-1 loss to Tottenham, Aribo's manager scolds his team as "not good enough."
Sports8 hours ago

Following a 4-1 loss to Tottenham, Aribo’s manager lashes out “not good enough.”

Mohammed Usman, Kamaru Usman's younger brother crowned UFC TUF Champion [Images/Video]
Sports8 hours ago

Mohammed Usman, Kamaru Usman’s younger brother crowned UFC TUF Champion [Images/Video]

Beauty BBNaija
Entertainment8 hours ago

BBNaija S7: Beauty says, “He’s fingered me and sucked my breast,” as she drags Groovy

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show
Entertainment8 hours ago

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show

Pep Guardiola
Sports8 hours ago

I’m not at Man City to win UEFA Champions League – Pep Guardiola

Festus Keyamo
News8 hours ago

Buhari Has Delivered, Security Only Exists In Heaven – Festus Keyamo

Dapo Abiodun
News9 hours ago

2023: Ogun State Is Nobody’s Inheritance – Dapo Abiodun

Your weekly tarot horoscope for July 24 to July 30 – and Jupiter going retrograde
Horoscope9 hours ago

Your weekly tarot horoscope for August 7 to August 13 and Venus’s move into Leo

Toolz - Tolu Oniru-Demuren
Entertainment9 hours ago

“Until A Man Is Financially Stable, He’s Not Truly Happy” – Toolz

Ishaq Oloyede
Education9 hours ago

Hard Decisions Needed To End ASUU Strike – JAMB boss

Dino Melaye
News9 hours ago

Bola Tinubu Sees Presidency As Retirement Benefits – Dino Melaye

Your daily horoscope for Monday, July 25, 2022
Horoscope9 hours ago

Your daily horoscope for Sunday, August 7, 2022

Vinicius Jr Wants Five or More UCL at Real Madrid
Sports10 hours ago

Vinicius Jr Wants Five or More UCL at Real Madrid

Diego Simeone
Sports10 hours ago

Why Juventus, Atletico Madrid Game Got Cancelled

Peruzzi
Entertainment10 hours ago

Peruzzi Bags 7-days Ultimatum To Refund ₦3 Million Over Breach of Contract

Thomas Tuchel
Sports10 hours ago

EPL: Thomas Tuchel revels Marcos Alonso’s decision

Messi and Neymar PSG vs Clermont Foot
Sports10 hours ago

Messi Scores Brace as PSG Effortlessly Thrashed Clermont Foot

Buhari
News10 hours ago

Buhari Vows To Track Down Killers Of Imo Police Officers

SADE'S HEART TALE
ANE Stories11 hours ago

[STORY] SADE’S HEART TALE (Episode 20)

Computer Video Game
Technology1 day ago

5 Reasons To Start Playing Computer Games

XSS in Gmail’s AMP For Email earns researcher $5,000
Technology1 day ago

XSS in Gmail’s AMP For Email earns researcher $5,000

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Complete Episodes)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Complete Episodes)

SADE'S HEART TALE
ANE Stories5 days ago

[STORY] SADE’S HEART TALE (Episode 19)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 01)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Complete Episodes)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 07)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 03)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 05)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 01)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 01)

Nwankwo Kanu, a Super Eagles icon, turns 46 [Photos]
Sports6 days ago

Nwankwo Kanu, a Super Eagles icon, turns 46 [Photos]

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 09)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 04)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 02)

Watch the latest "Passport" movie teaser with Mercy Johnson, Zubby Michael, and Jim Iyke
Entertainment6 days ago

Watch the latest “Passport” movie teaser with Mercy Johnson, Zubby Michael, and Jim Iyke

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 06)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 03)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Final Episode 04)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 05)

A sizable piece of Elon Musk's space junk has fallen onto an Australian man's farm.
Technology6 days ago

A sizable piece of Elon Musk’s space junk has fallen onto an Australian man’s farm.

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 04)

Google AdSense
How To6 days ago

How To Receive Google AdSense Payment To GTB, UBA, Access, FCMB, First Bank – SWIFT – BIC CODE

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 03)

Celebrity6 days ago

Hilda Dokubo comments on the ransom demanded for colleagues who have been kidnapped: “Some actors present the incorrect picture on social media.”

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 12)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories3 days ago

[STORY] THE WITCH’S DAUGHTER (Final Episode 09)

Monalisa Chida claims the abductor's phone may be used to find kidnapped Nollywood actors.
Celebrity5 days ago

Monalisa Chida claims the abductor’s phone may be used to find kidnapped Nollywood actors.

Kcee Marzz incorporates highlife in his latest song, "In the air,"
Entertainment6 days ago

Kcee Marzz incorporates highlife in his latest song, “In the air,”

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 06)

Sports5 days ago

The representatives of Victor Osimhen call a CRUNCH meeting to debate the future of Napoli.

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 08)

Epic movie "Anikulapo" by Kunle Afolayan is scheduled to premiere in September
Entertainment5 days ago

Epic movie “Anikulapo” by Kunle Afolayan is scheduled to premiere in September

Nancy Isime
Entertainment5 days ago

“Nancy Isime Did Butt Enlargement Surgery” – Blessing Okoro Makes Shocking Revelation

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 17)

Danielle's graduation is a cause for celebration for Jay-Jay Okocha.
Sports6 days ago

Danielle’s graduation is a cause for celebration for Jay-Jay Okocha.

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 10)

Nkem Owoh
Entertainment3 days ago

Nkem Owoh Breaks Silence On Claims He Rejected N10 Million To Endorse Bola Tinubu For President

Daniel Bachmann has won the race to start over Super Eagles goalkeeper Maduka Okoye for Watford this season
Sports3 days ago

Revealed: Why Watford goalkeeper Maduka Okoye was not included in the team on Monday

ANE's Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.