Flaws In GitHub Actions Bypass Code Review Mechanism

guest · Oct 14, 2021

Flaws In GitHub Actions Bypass Code Review Mechanism
Attackers Can Push Code To A Protected Branch
October 14, 2021
https://www.databreachtoday.com/flaws-in-github-actions-bypass-code-review-mechanism-a-17733

Researchers at Cider Security have uncovered a security loophole in GitHub Actions that allows adversaries to bypass the required reviews mechanism and push non-reviewed code to a protected branch, allowing it into the pipeline to production.

Lead security researcher Omer Gil and his team of researchers at Cider Security, a start-up focusing on continuous integration/continuous delivery security, found the vulnerability as part of their research for novel attacks in DevOps according to a blog post on Medium.
Click to expand...

Gil tells Information Security Media Group that required reviews is one of the most widely used security mechanisms in GitHub, and since GitHub Actions is installed by default - nearly any organization is vulnerable to this.

"An attacker compromising a GitHub user account, or simply a developer that wants to bypass this restriction, can simply push code to a protected branch. Since code in protected branches is usually used in production systems by many users or by other systems, the impact is high," Gil notes.
Click to expand...

However, any user with write access to a repository can modify the permissions granted to the token and can add or remove access as required by manipulating the permissions key in the workflow file, the researchers note.

If an attacker hijacks a user account, they can push code to a protected branch by creating a pull request with the intent to merge their malicious code to a protected branch.
Click to expand...

Log in or Sign up

Flaws In GitHub Actions Bypass Code Review Mechanism

guest Guest

Log in or Sign up

Flaws In GitHub Actions Bypass Code Review Mechanism

guest Guest

Useful Searches