Security concern: CI could leak github secrets
#297 geöffnet am 30.11.2025
Repository-Metriken
- Stars
- (37 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 5T 12h) (16 gemergte PRs in 30 T)
Beschreibung
I was recently watching a video about NPM's supply chain attack, and how its starting point was the exploitation of a github action. We may be vulnerable to a similar attack to on this repo by a willing malicious actor.
The culprit is on: pull_request_target. This is used in 2 places in our CI: testsuite_preview.yaml and labeler.yaml. The labeler workflow is probably safe (?), but the testsuite_preview is likely exploitable. See this article: https://shreyapohekar.com/blogs/how-attackers-exploit-pull_request_target-secure-your-github-ci-cd-workflows/ . We do exactly what we shouldn't do.
The purpose of that pull_request_target was to be able to have the workflow work for PRs sent from forks.
See also: https://www.wiz.io/blog/s1ngularity-supply-chain-attack
I recommend disabling the PR until a proper security analysis of the pipeline can be done. I unfortunately do not have the time to look into this myself, but please do look into this. I am concerned ☹️
Make sure to disable/remove/fix this CI from other branches as well, not just main.