StatewardStateward
← Toutes les vulnérabilités
HIGHSupply chaincurated

SC-ARTIPACKED-2024

CI/CD · GitHub Actions · GitHub Actions (actions/checkout, actions/upload-artifact)

Résumé

On August 13, 2024, Palo Alto Networks Unit 42 published ArtiPACKED, a widespread CI/CD misconfiguration class in which GitHub Actions build artifacts inadvertently leaked authentication tokens, affecting major open-source projects from Google, Microsoft, Red Hat, AWS, Canonical, and OWASP. The root cause is that actions/checkout persists credentials by default, writing the workflow's GITHUB_TOKEN into the checked-out .git/config for authenticated Git operations; when a later step uploaded the workspace (test results, build output, or the full checkout directory) via actions/upload-artifact, the .git directory and its embedded token, along with environment-derived secrets and cloud credentials, were packaged into the downloadable artifact. Because v4 artifacts can be downloaded while the run is still in progress and are readable by anyone for public repositories, an attacker could win a race condition: download the artifact, extract the still-valid GITHUB_TOKEN before the job completed and the token expired, and use it to push code, create branches, or pivot into connected cloud environments. Unit 42 identified numerous large projects leaking tokens this way and disclosed each responsibly for remediation.

Comment l’éviter dans votre code

  • Set persist-credentials: false in actions/checkout so tokens are not written into the .git directory.
  • Never upload the workspace or .git folder as an artifact; scope artifact contents tightly.
  • Scan artifacts for secrets and tokens before upload.
  • Apply least-privilege permissions to GITHUB_TOKEN and keep token lifetimes short.
  • Avoid echoing secrets or full environments into build logs and artifacts.

Références

Vulnérabilités liées

Tout Supply chain →