Gh Actions - Artifact Poisoning
学习和练习 AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
学习和练习 GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Artifact Poisoning
有几个 Github Actions 允许从其他仓库下载 artifacts。这些其他仓库通常会有一个 Github Action 来上传 artifact,之后会被下载。
如果攻击者能够以某种方式破坏 Github Action,他将能够破坏上传的 artifact,这可能会使他破坏使用它的其他工作流。
从不同仓库下载 artifact的示例:
![](https://cloud.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F366839394-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FEYi4M21WX4icNxsN0fBC%252Fuploads%252Fgit-blob-04471fecbfe7d94116dae05c22ef937a23f3a716%252Fimage%2520%28124%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=79c091e8&sv=1)
有关更多信息和防御选项(例如硬编码要下载的 artifact),请查看 https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust
学习和练习 AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
学习和练习 GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated