Supply Chain Attack - GitHub Actions
Description
In the Git Hub actions if they do not have their actions locked for a specific revision, if a malicious change is made to a third party action, this change will be included in the next build that is run for any project that uses that action.
Impact
Modify the workflow to execute tasks that steal data, introduce security vulnerabilities or perform harmful actions in the target environment.
Recommendation
Use mechanisms such as git-commits, or artifacts and hashes to verify the data integrity.
Threat
Authenticated attacker with access from the internet with write access to the provider's relays.
Expected Remediation Time
⌚ 15 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: L
- User interaction: R
- Scope: U
- Confidentiality: N
- Integrity: L
- Availability: N
Temporal
- Exploit code maturity: U
- Remediation level: O
- Report confidence: R
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:R
- Score:
- Base: 2.6
- Temporal: 2.2
- Severity:
- Base: Low
- Temporal: Low
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: L
- User interaction: P
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: U
Result 4.0
- Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- Score:
- CVSS-BT: 0.5
- Severity:
- CVSS-BT: Low
Compliant code
actions with locking
- uses: actions/checkout@v3
ref: f095bcc56b7c2baf48f3ac70d6d6782f4f553222
Non compliant code
actions
- uses: actions/checkout@v3
Requirements
Fixes
