Breaking the Build: How Attackers Abuse GitHub Actions
summary
Overview of concrete exploits against GitHub Actions: three classes—action expression injection (CVE-2023-34111) lets attacker-controlled PR titles inject shell commands and exfiltrate the GitHub token; poison pipeline execution runs attacker-controlled Makefiles after checkout; and a recent supply-chain chain-of-compromise uses a PR-trigger, stolen personal access tokens, and retagging to replace safe releases. Defenses shown: pin actions to use full commit SHA, apply job-level least privilege, prefer OIDC over PATs, and run CodeQL/OpenSSF scorecards; several incidents result in multi-repo token theft.
AI-written summary · about
chapters (7)
- 0:00GitHub Actions security intro
- 1:06What are GitHub Actions
- 5:23Action expression injection
- 7:35Poison pipeline attacks
- 8:58Supply chain via Actions
- 12:56Mitigation strategies
- 14:09Q&A
related talks
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
42mProtecting CI/CD from malicious deploys
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
15mGitHub Actions: a time bomb for supply chain security
57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measures
56mHow to use GitHub Actions with Security in mind
35mPwning the CI (GitHub Actions Edition)