facebook no scriptGitHub Actions flaw allows you to circumvent required code reviews | Secure Blink
GitHub Actions
Vulnerability
GitHub Actions flaw allows you to circumvent required code reviews
A security flaw in GitHub Actions will allow individuals to push unreviewed code to a protected branch or an organization...
thumbnail
Team SecureBlink
17 Oct 2021
3 min read

Omer Gil, a researcher at Cider Security discovered a method to bypass required reviews through GitHub Actions. If a threat actor gains control over one’s GitHub account, they can push code directly into the repository; this will make its way down the C1/CD pipeline. It can run unreviewed in the CI or find itself in the company’s productions.


One can set rules to limit an account with write permissions to push code directly into it, and this can be done by a user creating a pull request. Once a pull request is created, it needs approval from other members before it can be merged into the target branch. This reduces the risk of compromising an account since another user manually reviews it. It protects a company from developers pushing unreviewed code to sensitive branches.


Untitled

GitHub Actions is installed by default on any GitHub organization and repositories, meaning even if an organization does not use GitHub actions for CI, they are still vulnerable to this flaw. Permissions for any user can be created with write access to run a workflow in the repository, so an attacker with access to a user account who wants to push code into a protected branch can easily push malicious code to a remote branch along with the workflow. Workflow can approve all the pull requests using GitHub API; it is configured to run on pull_requests events and granted write permissions.


name: APPROVE
 
on: pull_request # run on pull request events
 
permissions:
 pull-requests: write # grant write permission on the pull-requests endpoint
jobs:
 approve:
   runs-on: ubuntu-latest
 
   steps:
     - run: | # approve the pull request
         curl --request POST \
         --url https://api.github.com/repos/${{github.repository}}/pulls/${{github.event.number}}/reviews \
         --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \
         --header 'content-type: application/json' \
         -d '{"event":"APPROVE"}'

Hence, when the pull request is created, it needs the approval to be merged, the workflow immediately runs, and the request is approved by github-actions bot, to which the GITHUB_TOKEN belongs.


Available Mitigation


  • If an organization does not use GitHub Actions, you must disable it entirely or for specific repositories.
  • If an organization uses GitHub Actions, increase the number of approvals to two or more and require a review approval in pull requests.