A critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, according to researchers with cybersecurity firm Tenable.
In an advisory issued April 21, Rémy Marot, staff research engineer at Tenable, wrote that “by exploiting this vulnerability, an attacker with an unprivileged GitHub account could exfiltrate secrets available to the workflow run and perform unauthorized operations on the target GitHub repository.”
The security flaw can be easily exploited, and illustrates the growing security risks as CI/CD pipelines play an increasingly central role in the software development field, according to Marot.
He found that the Microsoft GitHub repository was using a vulnerable GitHub workflow that allowed any GitHub user to set off remote code execution (RCE) in the GitHub runner. Through this, the bad actor could gain access to a token that let them run unauthorized actions on the repository and compromise the software supply chain.
Tenable described the repository as a “significant point of interaction for developers,” noting that it had been forked 5,000 times and has more than 7,700 stars. Because the source code for the repository was public, anyone with a registered GitHub account could easily exploit it.
‘Trivial’ Exploitation
Exploitation of the flaw was “trivial,” Marot wrote. All it took was for an attacker to open a GitHub issue – a built-in collaboration tool used by developers to document tasks, report bugs, or propose new features – which is open to any registered user, according to Tenable.
From there, the hacker could inject malicious Python code into the issue description, with the GitHub workflow automatically starting up when the issue was created. Doing so executed the attacker’s code within the GitHub runner, which runs the job in GitHub Actions workflow, essentially becoming the engine for the CI/CD pipeline.
The exploit allowed the threat actor to exfiltrate the GITHUB_TOKEN and other secrets on the repository. Depending on the permissions in the GITHUB_TOKEN, it could allow privileged operations on the repository, Marot said.
Tenable is giving the vulnerability a CVSSv4 severity score of 9.3 out of 10. Microsoft patched the vulnerable workflow via a pull request.
Rising CI/CD Threats
The vulnerability illustrates why developers need to view their CI/CD pipelines as critical pipelines and secure them accordingly, he said.
“The CI/CD infrastructure is part of an organization’s attack surface and software supply chain, requiring strict security controls to protect source code and build integrity,” Marot wrote in a FAQ accompanying the Tenable report. “Without strong safeguards, a vulnerability in a pipeline can be exploited to trigger large-scale supply chain attacks and have critical impacts on downstream systems and users.”
Security vendors for several years have been warning about the increasing focus that bad actors are putting on CI/CD infrastructure. The OWASP Foundation has listed the top 10 CI/CD security risks, ranging from insufficient flow control mechanisms and dependency chain abuse to insufficient credential hygiene and insecure system configuration.
“CI/CD environments, processes, and systems are the beating heart of any modern software organization,” the organization wrote. “They deliver code from an engineer’s workstation to production. Combined with the rise of the DevOps discipline and microservice architectures, CI/CD systems and processes have reshaped the engineering ecosystem.”
Expanding the Attack Surface
At the same time, they also have expanded the attack surface, creating new pathways for attackers.
“Adversaries of all levels of sophistication are shifting their attention to CI/CD, realizing CI/CD services provide an efficient path to reaching an organization’s crown jewels,” OWASP wrote. “The industry is witnessing a significant rise in the amount, frequency and magnitude of incidents and attack vectors focusing on abusing flaws in the CI/CD ecosystem.”
Trivy Attack a Recent Example
Cybersecurity consultancy IANS Research pointed to the recent supply chain attack that compromised Aqua Security’s Trivy open source security vulnerability scanner and associated GitHub Actions as an example of the growing focus of threat actors on software development processes, noting that it “has triggered a cascading compromise across CI/CD environments.”
“Threat actors are leveling up their supply chain attacks,” IANS researchers wrote in a blog post last month. “By combining a trusted security tool compromise with worm-like propagation and token hijacking, attackers turned trusted CI/CD workflows and package ecosystems into an easy channel for distributing malware.”
Tenable recommended that development teams implement “rigorous security measures” to protect source code, build integrity into automated workflows, and update and restrict GITHUB_TOKEN permissions. In addition, they need to regularly audit automated workflows to ensure there are no injection vulnerabilities that can be exploited by external user input.