TLDR Tech / InfoSec
Primer on GitHub Actions Security - Threat Model, Attacks and Defenses (Part 1/2)
Wiz maps the GitHub Actions threat model across three primary attack classes: pull_request_target misconfigurations (the “Pwn Request” class, exploited in the Trivy supply chain compromise), where fork PR authors manipulate checked-out artifacts to gain execution with base-branch secrets, script injection via unsanitized user-controlled context values like github.event.issue.title or github.head_ref injected into run blocks (the Ultralytics/YOLO XMRig incident root cause), and compromised third-party actions, illustrated by the tj-actions attack, which chained four sequential action compromises to target Coinbase across 22,000 affected repositories. Defenses include avoiding pull_request_target where possible, binding all user-controlled inputs to intermediate environment variables before shell execution, and pinning third-party actions to commit SHAs rather than mutable tags.
Read the full story