Gh Actions - Context Script Injections

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Kumbuka kwamba kuna baadhi ya github contexts ambazo thamani zake zinadhibitiwa na mtumiaji anayezalisha PR. Ikiwa hatua ya github inatumia data hiyo kutekeleza chochote, inaweza kusababisha kutekelezwa kwa msimbo usio na mipaka. Muktadha huu kwa kawaida huishia na body, default_branch, email, head_ref, label, message, name, page_name,ref, na title. Kwa mfano (orodha kutoka kwa writeup):

• github.event.comment.body

• github.event.issue.body

• github.event.issue.title

• github.head_ref

• github.pull_request.*

• github.*.*.authors.name

• github.*.*.authors.email

Kumbuka kwamba hapa kuna vyanzo visivyo wazi vya pembejeo zisizoaminika, kama vile majina ya matawi na anwani za barua pepe, ambazo zinaweza kuwa zaidi ya kubadilika katika maudhui yao yanayoruhusiwa. Kwa mfano, zzz";echo${IFS}"hello";# ingekuwa jina halali la tawi na ingekuwa njia inayoweza kutumika kushambulia hifadhi lengwa.

Example of a script injection attack

Shambulio la kuingiza skripti linaweza kutokea moja kwa moja ndani ya skripti ya ndani ya mchakato. Katika mfano ufuatao, hatua inatumia expression kuthibitisha uhalali wa kichwa cha ombi la kuvuta, lakini pia inaongeza hatari ya kuingiza skripti:

- name: Check PR title
run: |
title="${{ github.event.pull_request.title }}"
if [[ $title =~ ^octocat ]]; then
echo "PR title starts with 'octocat'"
exit 0
else
echo "PR title did not start with 'octocat'"
exit 1
fi

Kabla ya skripti ya shell kuendesha, maelezo ndani ya ${{ }} yanapimwa na kisha kubadilishwa na thamani zinazotokana, ambayo inaweza kufanya iwe hatari kwa kuingizwa kwa amri za shell.

Ili kuingiza amri katika mchakato huu, mshambuliaji anaweza kuunda ombi la kuvuta lenye kichwa cha a"; ls $GITHUB_WORKSPACE"

Katika mfano huu, herufi " inatumika kukatiza taarifa ya title="${{ github.event.pull_request.title }}", ikiruhusu amri ya ls kutekelezwa kwenye runner.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.