Top Highlights
- The new GitHub "actions/checkout" update blocks malicious "pull_request_target" requests from forks, preventing attackers from executing untrusted code with full privileges.
- Attackers can exploit "pull_request_target" workflows to steal secrets, inject malicious code, or gain unauthorized access by submitting malicious PRs from forks.
- Despite protections, workflows with elevated permissions or unreviewed untrusted repositories remain vulnerable to pwn request attacks, risking secret leaks and privilege escalation.
Threat, Techniques, and Targets
GitHub has updated its “actions/checkout” to block common pwn request attack patterns. These attacks exploit the “pull_request_target” workflow trigger. Attackers use this trigger to run malicious code with full privileges. The attack works when pull requests come from forks. It targets repositories that include workflows using “actions/checkout” from forked repositories. The attacker submits malicious code in a pull request. When the workflow checks out and runs this code, it can steal secrets or gain unauthorized access. Recent attacks have included weaponized software packages and breaches of popular projects. The goal is to prevent attackers from exploiting the “pull_request_target” trigger to run harmful code in workflows.
Impact, Security Implications, and Guidance
This update aims to reduce the risk of pwn request attacks in GitHub workflows. By refusing to fetch code from insecure fork pull requests, the change protects repositories from malicious code execution. It mainly affects “pull_request_target” workflows from forks, which can run with elevated permissions. This means that workflows could be compromised if they check out untrusted code from forks. Developers should review workflows that use “pull_request_target” and only use it when necessary. They should also restrict permissions and prevent untrusted input from executing harmful code. For detailed remediation guidance, developers are advised to consult the official guidance from GitHub or relevant security authorities.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
