Breaking and Protecting GitHub IssueOps Pipelines
summary
Shows how IssueOps comment- or label-triggered GitHub Actions can let untrusted forks run privileged jobs and exfiltrate secrets or abuse paid APIs. Demonstrates two real attack patterns: time-of-check to time-of-use (inject a commit between approval and runner start) and broken access control via issue comments (anyone can trigger privileged workflows). Practical mitigations: split unprivileged and privileged workflows, pin the reviewed commit SHA or require repo-member labeling before granting secrets, and validate commenter identity and timestamps.
AI-written summary · about
chapters (8)
- 0:00GitHub IssueOps security
- 1:09IssueOps workflows and triggers
- 2:37Privileged workflow risks
- 4:45Threat model for GitHub Actions
- 6:55Access control in triggers
- 8:01TOCTOU attacks on workflows
- 10:32Mitigating with trusted commits
- 12:21Securing CI/CD pipelines
related talks
42mProtecting CI/CD from malicious deploys
23mBreaking the Build: How Attackers Abuse GitHub Actions
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
28mPwning the CI (with GitHub Action Workflows)
56mHow to use GitHub Actions with Security in mind
35mPwning the CI (GitHub Actions Edition)
57mGitHub Actions: A Cloudy Day for Security
51mHow to secure your GitHub Actions