Ensure pull_request_target workflows do not check out or run untrusted pull request code

KritischStufe 1Automatisiertsupply-chain

Beschreibung

pull_request_target runs in the context of the base repository with a write-scoped GITHUB_TOKEN and access to secrets. Checking out the PR head (github.event.pull_request.head.sha/ref, github.head_ref, refs/pull/*) and building it lets any fork author execute code with those privileges ('pwn request'). The audit flags workflow files that use pull_request_target and reference the PR head anywhere; review flagged files manually.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

top=$(git rev-parse --show-toplevel 2>/dev/null) || exit 1
cd "$top" || exit 1
wf=$(git ls-files -- '.github/workflows/*.yml' '.github/workflows/*.yaml' 2>/dev/null) || exit 1
bad=$(printf '%s\n' "$wf" | while IFS= read -r f; do
  [ -n "$f" ] || continue
  if grep -qE '^[^#]*pull_request_target' "$f" &&
     grep -qE '^[^#]*(github\.event\.pull_request\.head\.(sha|ref|repo)|github\.event\.pull_request\.merge_commit_sha|github\.head_ref|refs/pull/)' "$f"; then
    echo "$f"
  fi
done)
if [ -z "$bad" ]; then echo compliant; else echo "pull_request_target workflows that reference the untrusted PR head:"; printf '%s\n' "$bad"; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Switch the workflow to the pull_request trigger (no secrets, read-only token), or split it: build untrusted code under pull_request and upload artifacts, then process them in a separate workflow_run job that never executes PR code. If pull_request_target is unavoidable, do not check out the head ref and set permissions: read-all.

Eigenschaften

Betriebssysteme: Beliebig
Tags: supply-chainbuild-pipelinegithub-actions
Referenz: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - Build Pipelines - isolate untrusted code from pipeline secrets (verify section number for your release)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target supply-chain