Intriguing

[fproulx-boostsecurity]

I find this scripts/test/github-event-object-is-snapshot.sh intriguing

https://github.com/nikitastupin/pwnhub/commit/e098ccfbe889e2c5f0ae9169be58c55430d7a65b#diff-da7ba472d28c68dd7a9924155379ecfdedb107998ea36323e6adbb61fb192061

Not quite sure what to make of it

[nikitastupin]

Hey @fproulx-boostsecurity! The script basically creates a test repo and shows that values of the ${{ github.event }} object are "frozen" at the moment of running the workflow (or rather emitting the event I guess). This behaviour is rather an edge-case but I've seen a couple of subtle vulnerabilities because of that.

[fproulx-boostsecurity]

hmmm OK. so you mean if there is a race condition between the content of github.event used in some boolean logic to apply something, while the underlying repo state has already changed.... interesting to consider indeed. I guess certain things are frozen (Git commit sha , ref, etc.) but maybe other things could change around and could lead to non obvious bugs

Cool. If you are willing to share one such example (in DM if you want, let me know) https://twitter.com/francoisproulx/

[nikitastupin]

Yes, that's how it works in general. So far I have only one example and it's not fixed yet so unfortunately I can't disclose for now :)

[nikitastupin]

Thanks for https://boostsecurityio.github.io/lotp/ by the way! I ought to add it to the README

[AdnaneKhan]

So in summary to find issues of this class one should look for the following?

pull_request_target on the labeled trigger only + actions/checkout with ref: ${{ github.event.pull_request.head.ref }} and repository: ${{ github.event.pull_request.head.repo.full_name }} + the workflow runs the PR code

(or any variation of the above)

[nikitastupin]

So in summary to find issues of this class one should look for the following?

pull_request_target on the labeled trigger only + actions/checkout with ref: ${{ github.event.pull_request.head.ref }} and repository: ${{ github.event.pull_request.head.repo.full_name }} + the workflow runs the PR code

(or any variation of the above)

Yes, that's right!

[nikitastupin]

It's basically a TOCTOU vulnerability

[AdnaneKhan]

It's basically a TOCTOU vulnerability

Ended up writing a tool + demo repo to make this easy to exploit (https://github.com/AdnaneKhan/ActionsTOCTOU/)

[nikitastupin-openzeppelin]

Looks awesome! We should add this and the other recent blog posts to the README! (shoot wrong account 😅)

[nikitastupin]

Done https://github.com/nikitastupin/pwnhub/commit/aa736f201a4f5350df7ddfbafda4300a9f40bd31