GitHub Actions: Vulnerabilities, Attacks, and Counter-measures
summary
Shows that GitHub Actions runners (Azure VMs) are abused at scale to mine cryptocurrency using an XMRig miner embedded in workflow steps and to persist via legitimate helpers like the actions/checkout dependency and a retry action that respawns jobs. Demonstrates a working reverse shell via netcat from the runner to an external C2 over allowed egress on port 443, then uses nmap for lateral discovery; finds hundreds of near-identical malicious repos, artifacts vanish when runners terminate, and GitHub tokens grant repo-level access only while jobs run.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:11@magnologan
- 4:34GitHub Codespaces
- 12:25Overview - Marketplace
- 14:03Overview - Actions in Action
- 17:56Vulnerabilities
- 21:30Leveraging third-party GHA
- 22:33Abusing Windows Runners pt 2
- 24:57Abusing Linux Runners
- 29:58Command Injection via untrusted inputs
- 30:46Malicious GitHub Actions
- 37:27Run nmap inside the Azure network
- 39:09Reverse shell from the Runner
- 41:00Pivot attacks using Runners
- 41:19Countermeasures
related talks
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
23mBreaking the Build: How Attackers Abuse GitHub Actions
54mAbusing GitHub for fun and profit: Actions and Codespaces Security
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
36mGithub Actions Security Landscape
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
42mProtecting CI/CD from malicious deploys
28mPwning the CI (with GitHub Action Workflows)