Bypassing Branch Protections with Github Actions (CI/CD)
Source: YouTube · John Hammond · published Jun 14, 2023 · 19:34
Researchers demonstrate methods to bypass GitHub branch protections, specifically highlighting the risks associated with automated GitHub Actions bots and default organizational settings that may allow malicious code to be approved and merged without manual oversight.
Key Takeaways:
• GitHub branch protections generally require pull requests, approvals, and code owners to secure the main branch, though these mechanisms can be circumvented if configuration is not strictly enforced.
• Organizations created before December 2022 often have a critical setting enabled by default that permits GitHub Actions to create pull requests and submit approvals, making them highly vulnerable to automation attacks 5:50.
• Attackers can configure a malicious GitHub Action to create a pull request containing malicious code and have the GitHub bot auto-approve it, effectively bypassing manual review requirements 9:17.
• If code owner approval is required, an attacker can compromise a legitimate code owner account to approve the bot-generated pull request, further evading protection rules 10:30.
• Even administrative users can bypass branch protections if specific "bypass protection" settings are toggled incorrectly, allowing direct pushes to the protected main branch 12:14.
To mitigate these risks, organizations should audit their settings to disable the "Allow GitHub actions to create pull requests and submit approvals" option in their organization's Actions General settings.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
but if you have an existing organization that was created before I believe 2022 in December I think oh it's relatively recent yeah yeah if it was before this will be checked because it was the default behavior before so there's still a lot of companies that are vulnerable to this and we find it a lot in in our in our audits sweet thanks so much super happy to be joining both you fellas One More Time Ignacio and Carlos all the great folks rocking over at halborn and we've been chatting a little bit about cicd continuous integration continuous delivery continuous deployment however you want to interpret that CD last end of it uh and in the last little showcase we got to see I believe that was what direct pipeline poisoning as one of the attacks and that is just the tip of the iceberg from wh…