GitHub Actions Security Breach: Leaked Auth Tokens in Major Repositories

Multiple high-profile open-source projects from major technology companies, including Google, Microsoft, AWS, and Red Hat, have been identified as leaking GitHub authentication tokens through artifacts generated by GitHub Actions in their CI/CD workflows. This issue poses significant security risks, as unauthorized access to these tokens can enable attackers to gain entry into private repositories, steal source code, or inject malicious code into projects.

The vulnerability was highlighted by Palo Alto Networks' Unit 42, which pinpointed a combination of factors contributing to the leakage. These factors include insecure default settings, user misconfigurations, and insufficient security measures. Unit 42 has referred to this vulnerability as an "ArtiPACKED" attack.

A primary risk factor is the use of the 'actions/checkout' action within GitHub workflows. This action is commonly employed to clone the repository code so it can be accessed during the workflow execution. By default, this action saves the GitHub token in a hidden local .git directory to facilitate authenticated operations. If users accidentally include this entire checkout directory as part of an artifact, the GitHub token becomes exposed and accessible.

Besides tokens, other sensitive information stored in the .git directory may include API keys, cloud service access tokens, and various account credentials. Similar risks arise from artifacts created during the CI/CD process, such as build outputs and test results, which are stored and remain accessible for up to three months. If these artifacts are inadvertently uploaded, they could expose sensitive information.

Another significant vulnerability occurs when CI/CD pipelines use environment variables to store GitHub tokens. If actions or scripts within the workflow log these variables—whether intentionally or due to misconfiguration—the logs are also uploaded as artifacts. For example, the 'super-linter' action, when configured with the 'CREATE_LOG_FILE' property set to 'True,' can generate detailed logs that include environment variables, which then become exposed.

Attackers can exploit these leaks by targeting specific scenarios where ephemeral GitHub tokens must be extracted from logs and used before they expire. Although GitHub tokens are valid only for the duration of the workflow job—which varies depending on the workflow—the 'Actions_Runtime_Token' used by GitHub for internal caching and artifact management is generally valid for up to six hours, creating a small window for exploitation.

Custom secrets and tokens, such as API keys or access tokens for cloud services, can have different lifespans, ranging from a few minutes to indefinitely. Unit 42 outlines an attack scenario where automated scripts scan projects or public repositories utilizing GitHub Actions, identify conditions likely to result in artifact generation, and then download and examine these artifacts for sensitive information.

To mitigate these security risks, GitHub users are advised to take several precautions. They should avoid including entire directories in uploaded artifacts, sanitize logs to ensure that sensitive information is not included, and regularly review and update CI/CD pipeline configurations. Additionally, users should adjust default settings for actions like 'actions/checkout' to prevent credentials from being stored persistently and apply the principle of least privilege to tokens used within workflows to minimize potential damage in the event of exposure.