Actions have consequences: The overlooked Security Risks in 3rd party GitHub Actions

Ground Floor, 14:30 Wednesday After reviewing the build logs of public CI pipelines, I noticed security issues related to permissions and build integrity. To investigate the extent of the problem, I analyzed the build logs of the top 2,000 starred r...

Ground Floor, 14:30 Wednesday

After reviewing the build logs of public CI pipelines, I noticed security issues related to permissions and build integrity. To investigate the extent of the problem, I analyzed the build logs of the top 2,000 starred repositories on GitHub, and the results surprised even me. In this talk, I will share my findings on the prevalence of the world’s most popular repositories that fail to manage their build permissions. Such failure can lead to severe consequences, such as creating tokens to access cloud resources or introducing malware to repository code and artifacts. Next, I will uncover the existence of “unpinnable actions.” We will challenge a highly recommended countermeasure for protecting against compromised third-party actions: pinning. Pinning assures that the action’s code cannot be tampered with. However, even when pinned, new malicious code can still sneak into your pipeline. I will share the conditions that make an action unpinnable and reveal the significant percentage of the world’s most popular actions that we all use and pin, but are actually unpinnable.

Yaron Avital