[SECURITY] Organization Variables Exposed in Plain Text to All Repository Users

從 src/treeViews/settings/orgVariablesNode.ts 和 src/treeViews/settings/variableNode.ts 開始，然後使用非管理員帳戶重現組織變數請求。將擴充功能的 endpoint 和 auth flow 與 REST、CLI 和 web 的文件化行為進行比較。當非管理員使用者無法檢視組織變數值，且行為符合預期的權限模型時，即表示完成。

[SECURITY] VS Code GitHub Actions extension exposes organization variables to non-admin users

Summary

The GitHub Actions extension for VS Code exposes organization-level Actions variable values (names + values) to non-admin users via the “Settings → Variables → Organization Variables” view.

This is a privilege escalation:

• GitHub Web UI correctly blocks non-admins from viewing org variables
• gh api repos/{owner}/{repo}/actions/organization-variables correctly fails for non-admins
• Direct REST calls with a non-admin token also fail
• But the VS Code extension shows the full values to the same non-admin users

Impact

Severity: Critical – privilege escalation & credential disclosure

For any repo where org variables are shared:

• Non-admin users with only read access to the repo can see:
  • All shared org variable names
  • Their plain-text values in the VS Code sidebar
• In our case this exposed (now rotated and moved to Secrets):
  • GITLAB_API_TOKEN (full access to GitLab Package Registry)
  • GITLAB_API_READ_TOKEN
  • Multiple third‑party service passwords

How to Reproduce

1. Setup

   • In a GitHub organization:
     • Create organization-level Actions variables with sensitive values
     • Share them with a repository
   • Add a non-admin user with read access to that repository

2. As the non-admin user

   • Confirm that the org variables are not visible elsewhere:

     • Web: Org Settings → Actions → Variables → access denied

     • CLI:

       gh api repos/{owner}/{repo}/actions/organization-variables
       # => “Must have admin rights to Repository”
       

   • In VS Code:

     • Install github.vscode-github-actions
     • Open the repo
     • Open “GitHub Actions” view → “Settings” → “Variables” → “Organization Variables”

   Observed: All organization variables and their values appear in plain text.

Suspected Source

From the public repo:

• src/treeViews/settings/orgVariablesNode.ts:

  variables = await this.gitHubRepoContext.client.paginate(
    "GET /repos/{owner}/{repo}/actions/organization-variables",
    { owner: this.gitHubRepoContext.owner, repo: this.gitHubRepoContext.name, per_page: 100 }
  );
  return variables.map(v => new VariableNode(this.gitHubRepoContext, v, undefined, true));
  

• src/treeViews/settings/variableNode.ts:

  export class VariableNode extends vscode.TreeItem {
    constructor(/* ... */, public readonly variable: OrgVariable, /* ... */) {
      super(variable.name);
      this.description = variable.value; // shown directly in tree view
    }
  }
  

So the extension:

1. Calls the org variables API for the current repo
2. Wraps each result in a VariableNode
3. Sets description = variable.value, which is rendered in the tree view

The critical question: why does this succeed for non-admin users when the same endpoint fails via gh api and curl?

Expected Behavior

• For non-admins:
  • Either:
    • Do not show “Organization Variables” at all, or
    • Show only names, with values masked / hidden
• Enforce the same permission checks as:
  • GitHub Web UI
  • GitHub CLI
  • Direct REST calls

Mitigations (for other users)

Until fixed, organizations should:

• Rotate any secrets stored in organization variables that may have been exposed
• Move sensitive values to GitHub Secrets
• Avoid using this extension, or at least hide “Settings → Variables” from non-admins

Request

Can the team:

1. Confirm the behavior with a non-admin test account?
2. Clarify which endpoint + auth flow the extension uses here?
3. Align the extension’s behavior with GitHub’s documented and enforced permission model for org variables?