github-actions-script-injection

GitHub Actions Script Injection

What Is Broken and Why

GitHub Actions workflows interpolate context expressions like ${{ github.head_ref }} directly into shell run: steps at workflow parse time — before the shell executes. An attacker who controls the input (branch name, PR title, issue body, commit message) can inject arbitrary shell commands that execute with the workflow's token permissions. Even a read-only token becomes dangerous if it can be leveraged into cache poisoning, secret exfiltration via subsequent workflows, or SSRF to internal services.

Key Signals

• run: steps containing ${{ github.head_ref }}, ${{ github.event.pull_request.title }}, ${{ github.event.pull_request.body }}, ${{ github.event.issue.title }}, ${{ github.event.issue.body }}, ${{ github.event.comment.body }}
• pull_request_target trigger (runs in base repo context — elevated permissions + secrets)
• workflow_run consuming artifacts or outputs from untrusted workflows
• issue_comment, pull_request_review_comment triggers with body interpolation
• Workflows that echo, log, or use attacker-controlled strings in shell steps
• ${{ toJson(github.event) }} piped into scripts
• Missing env: variable indirection (safe pattern uses env: VAR: ${{ expr }} then $VAR)

Methodology

1. Enumerate all workflow files: find .github/workflows -name "*.yml" -o -name "*.yaml"
2. Grep for dangerous context variables used directly in run: blocks:

   grep -rn 'run:' .github/workflows/ | grep -E '\$\{\{.*github\.(head_ref|event\.'
   

3. For each hit, trace the trigger: is it pull_request, pull_request_target, issue_comment, workflow_dispatch?
4. Check token permissions: permissions: block or default GITHUB_TOKEN scope.
5. Identify what secrets are available in the workflow environment.
6. Craft a branch name (or PR title/body) with injection payload.
7. Open a PR from a fork using the malicious branch name to trigger the workflow.
8. Confirm RCE via out-of-band callback (DNS/HTTP to CALLBACK server).
9. Escalate: exfiltrate secrets, poison cache, pivot to downstream workflows.