pwn-request

Pwn Request

What Is Broken and Why

A "Pwn Request" occurs when a pull_request_target workflow — which runs in the context of the base repository with access to its secrets — explicitly checks out the PR contributor's code and executes it (via npm install, make, build scripts, etc.). pull_request_target was designed to safely access secrets for things like posting comments on PRs from forks, but developers mistakenly combine it with a checkout of the PR head SHA, collapsing the trust boundary. Any attacker who can open a PR can now execute arbitrary code with the repository's GITHUB_TOKEN and all configured secrets. The npm preinstall/postinstall lifecycle scripts are the most common execution vector — they run automatically during npm install / npm ci with no additional flags required unless --ignore-scripts is explicitly set.

Key Signals

• on: pull_request_target trigger in a workflow file
• actions/checkout step with ref: ${{ github.event.pull_request.head.sha }} or ref: ${{ github.head_ref }}
• Package manager install step after that checkout: npm install, npm ci, yarn, pnpm install
• --ignore-scripts=false explicitly set (overrides safe default) or --ignore-scripts absent
• permissions: contents: write or secrets.* accessible in the same job
• Build/test job that runs attacker's code AND has access to publish tokens or deployment keys
• Cache key derived from hashFiles('**/package.json') — attacker controls package.json

Methodology

1. Find all pull_request_target workflows:

   grep -rln 'pull_request_target' .github/workflows/
   

2. For each, check if actions/checkout references PR head code:

   grep -A5 'actions/checkout' .github/workflows/WORKFLOW.yml | grep 'head.sha\|head_ref'
   

3. Identify what runs after checkout: npm install, yarn, pnpm, make, build scripts.
4. Check if --ignore-scripts is set. If absent or =false, lifecycle scripts execute.
5. Enumerate secrets accessible in the workflow (secrets.* references, environment names).
6. Check if the same cache key is shared with a privileged downstream workflow (release, publish).
7. Craft malicious package.json with payload in preinstall or postinstall.
8. Open a PR from a fork — workflow triggers automatically.
9. Collect exfiltrated secrets via CALLBACK server or OOB DNS.