Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts

Summary: Unit 42 researchers found that GitHub Actions artifacts from CI/CD workflows leak credentials, including GITHUB_TOKEN (ghs_ prefix) and ACTIONS_RUNTIME_TOKEN (a JWT valid about six hours), because actions/checkout persists the token into the .git directory and users upload the whole checkout directory as an artifact. The release of upload-artifact@v4, which allows downloading artifacts while a workflow is still running, created a race condition that let the researcher extract a leaked GITHUB_TOKEN before job completion and create a branch in the open-source project clair without write permission.

What's compelling: Vulnerable public repositories included projects owned by Red Hat, Google, AWS, Canonical, Microsoft and OWASP, which before mitigation could have affected millions of their users; the same leaked tokens can push malicious code into production through the pipeline or expose secrets stored in the repository and organization.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related