close
close

ArtiPACKED bug makes GitHub Actions vulnerable to token leaks

Discover how GitHub Actions artifacts leak sensitive authentication tokens, exposing popular open source projects to security risks. Learn about the ArtiPACKED vulnerability, how it works, and what steps you can take to protect your projects from potential attacks.

Palo Alto Networks' Unit 42 has discovered a critical vulnerability in GitHub Actions. This flaw, dubbed “ArtiPACKED,” allows attackers to potentially steal sensitive information from popular open source projects, including GitHub authentication tokens.

FYI: GitHub Actions uses workflow build artifacts such as compiled code, test reports, and deployment packages to prevent data loss and promote efficient execution within the GitHub Actions environment. The vulnerability lies in the way GitHub Actions handles artifacts during the continuous integration/continuous delivery (CI/CD) workflow. Artifacts can be generated at various points in the pipeline, including build outputs and test results, and the way they are generated and stored can introduce security risks, such as the following scenarios.

Insecure default settings:

The actions/checkout action, commonly used to clone the repository code for the workflow, stores the GitHub token in the local, hidden .git directory by default. However, if the entire checkout directory is accidentally uploaded as an artifact, the token becomes visible to anyone with read access to the repository.

Accidental uploads:

Uploading the entire checkout directory, which contains the .git folder with the token, inadvertently makes the token available within the artifact.

Environment variable leaks:

CI/CD pipelines often use environment variables to store sensitive data such as tokens. If these variables are accidentally or intentionally logged during workflow execution, they are uploaded as artifacts, potentially exposing the tokens.

These issues result in attackers being able to potentially find and exploit leaked tokens in artifacts. They can exploit them by attacking certain scenarios with race conditions to extract short-lived tokens from logs before they expire. The exploitation effectiveness of the tokens varies depending on the token type.

For example, Actions_Runtime_Token, used internally by GitHub to manage artifacts, is typically valid for only six hours, while custom tokens, including API keys or access tokens for cloud services, can have different lifetimes ranging from a few minutes to indefinitely.

Additionally, attackers could use automated scripts to identify projects using GitHub Actions and then scan for vulnerabilities that could lead to artifact generation. These scripts could then download the artifacts and scan for exposed secrets.

“A combination of misconfigurations and security flaws can cause artifacts to lose tokens, both from third-party cloud services and GitHub tokens, making them available to anyone with read access to the repository,” the researchers noted.

If these tokens are compromised, attackers can gain unauthorized access to private repositories, allowing them to steal source code or even inject malicious code into projects. Unit 42's report highlights specific cases where popular projects, including those from Google, Microsoft, AWS, and Red Hat, have been found to have tokens leaked via these vulnerabilities.

Unit 42 reported 14 cases of large open source projects losing tokens, highlighting the need for robust security practices in CI/CD pipelines, especially in automated workflows. Developers and project owners can mitigate this risk by reviewing and cleaning directories, adjusting defaults for sensitive actions, and minimizing token permissions.

Glenn Chisholm, CEO and co-founder of Obsidian Security, commented on this story: “The finding underscores the importance of authentication tokens and shows how attackers are increasingly using stolen human and non-human authentication tokens to access source code and SaaS applications,” Genn explained.

“Organizations should ensure they look for abnormal patterns related to the use of authentication tokens. And since GitHub puts responsibility on the enterprise and users, they should ensure good configuration hygiene and scanning of their repos and workflows to avoid inadvertent token leakage,” he added.

  1. 3,000 fake GitHub accounts used to spread malware
  2. Personal GitHub repos reveal employees’ cloud secrets
  3. Anyone can access deleted, private GitHub repository data
  4. Caught AGAIN releasing malware as PoCs from fake GitHub repos!
  5. GitHub comments spread malware in fake Microsoft repositories

You may also like...