New GitHub Actions Attack Chain Uses Fake CI Updates to Exfiltrate Secrets and Tokens

A new sophisticated attack chain targeting GitHub repositories has emerged, leveraging fake Continuous Integration (CI) updates to steal secrets and tokens from vulnerable GitHub Actions workflows. Here's a breakdown of the threat:

How the Attack Works

1. Abuse of pull_request_target Trigger:

   • The attacker exploits the pull_request_target trigger in GitHub Actions.
   • Unlike the standard pull_request trigger, this one runs entirely within the context of the base repository, granting full access to repository secrets even when the PR originates from an untrusted external fork account.

2. Five-Phase Operation:

   • First Phase: Extracts the GITHUB_TOKEN from git configuration, compresses it, and writes a base64-encoded output to workflow logs for later retrieval by the attacker.
   • Second Phase: Uses the stolen token to call GitHub's API to map out secret names, deployment environments, and workflow files. Simultaneously probes cloud metadata endpoints (AWS, Azure, Google Cloud) for credentials.
   • Third Phase: A background daemon watches the Linux /proc filesystem every two seconds for ten minutes, catching any secrets loaded by later job steps, and posts captured data directly to PR

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.