This article reveals how misconfigurations in GitHub Actions workflow artifacts can expose sensitive tokens (like GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN) and what attackers could do with them, including pushing malicious code or replacing artifacts. It also covers mitigation efforts, including a PoC action to scan artifacts for secrets and community collaboration to remediate exposed projects. #GITHUB_TOKEN #ACTIONS_RUNTIME_TOKEN #SchemeCrawler #clair #firebase-js-sdk
Keypoints
- Vulnerability discovery: GitHub Actions artifacts can leak sensitive tokens, such as GitHub and cloud service tokens, due to misconfigurations.
- Impact on organizations: High-profile open-source projects from major companies were found vulnerable, potentially affecting millions of users.
- Token leakage mechanisms: Common practices like uploading entire checkout directories or logging environment variables led to token exposure.
- Exploitation techniques: Attackers can leverage leaked tokens to push malicious code or replace artifacts in CI/CD workflows.
- Mitigation strategies: Development of a PoC action to scan for secrets before artifact uploads to promote secure practices.
- Collaboration with maintainers: Researchers worked with project maintainers to quickly mitigate disclosures, highlighting community cooperation.
MITRE Techniques
- [T1003] Credential Dumping – Extracting sensitive tokens from GitHub Actions artifacts. [‘Extracting sensitive tokens from GitHub Actions artifacts.’]
- [T1203] Exploitation for Client Execution – Using leaked tokens to push malicious code to repositories. [‘Using leaked tokens to push malicious code to repositories.’]
- [T1203] Remote Code Execution – Exploiting artifacts to execute malicious code on CI/CD runners. [‘Exploiting artifacts to execute malicious code on CI/CD runners.’]
- [T1213] Data from Information Repositories – Accessing sensitive information from public artifacts. [‘Accessing sensitive information from public artifacts.’]
Indicators of Compromise
- [Token] Leaked credentials in artifacts – GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN; GITHUB_TOKEN persisted in the .git directory and found in artifacts, and ACTIONS_RUNTIME_TOKEN (JWT) with ~6-hour expiry found in artifacts
- [URL] Public GitHub repositories where tokens were leaked – https://github.com/microsoft/typescript-bot-test-triggerer/blob/0ef06130c0f7d78e1da6704bc0b447eacd79455c/.github/workflows/deploy.yml#L39, https://github.com/schemacrawler/SchemaCrawler/blob/11ba4a48bb410e9c20a550bd00a793c82471ce89/.github/workflows/linter.yml#L55
- [Artifact] Public artifacts containing secrets – artifacts uploaded by workflow runs (including logs from super-linter that print environment variables) and 1 more artifact containing a leaked token
Read more: https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/