gha-hazmat/.github/workflows/artipacked.yml at main · woodruffw/gha-hazmat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# artipacked.yml
#
# what:
# an example of the "ArtiPACKED" vulnerability, wherein an attacker
# can obtain short-lived actions credentials (i.e. the default
# GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN) that are accidentally
# persisted to a publicly accessible artifact.
#
# how:
# by default, the `actions/checkout` action persists the current `GITHUB_TOKEN`
# and `ACTIONS_RUNTIME_TOKEN` in the checked-out repo's `.git/config`,
# for use by subsequent `git` operations. this repo config is not normally
# made public or leaked, but can be accidentally leaked by use of
# `actions/upload-artifact` on the entire repo directory or similar.
# users are not typically aware that `actions/checkout` places credentials
# in their repos by default, leading to the assumption that creating a public
# artifact is always safe.
#
# see also: https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  # trivial example, with credential persistence flowing directly to artifact
  # creation.
  vulnerable-1:
    runs-on: ubuntu-latest
    steps:
      # NOT OK: actions/checkout persist-credentials enabled (default)
      - name: Checkout
        uses: actions/checkout@v4

      # NOT OK: upload-artifact archives entire repo, including persisted creds
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: artipacked
          path: .

  # non-trivial example, with persistence flowing to artifact creation
  # via a manually-created archive (in a shell step)
  # minimized from firebase-js-sdk:
  # https://github.com/firebase/firebase-js-sdk/blob/4f157b486833/.github/workflows/test-all.yml
  vulnerable-2:
    runs-on: ubuntu-latest
    steps:
      # NOT OK: persists credentials
      - uses: actions/checkout@v3

      # NOT OK: archives the entire repo, including persisted creds
      - name: Archive build
        if: ${{ !cancelled() }}
        run: |
          tar -cf build.tar .
          gzip build.tar

      # NOT OK: archive includes persisted creds
      - name: Upload build archive
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v3
        with:
            name: build.tar.gz
            path: build.tar.gz

  # trivial example, with persitence flowing directly to
  # artifact creation via `github.workspace`.
  # minimized from quay/clair:
  # https://github.com/quay/clair/blob/1d338051f374/.github/workflows/tests.yml
  vulnerable-3:
    runs-on: ubuntu-latest
    steps:
      # NOT OK: persists credentials
      - name: Checkout
        uses: actions/checkout@v4

      # NOT OK: archives and uploads entire workspace
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: workspace
          path: ${{ github.workspace }}