Ensure pull_request_target workflows do not check out or run untrusted pull request code

심각레벨 1자동supply-chain

설명

pull_request_target runs in the context of the base repository with a write-scoped GITHUB_TOKEN and access to secrets. Checking out the PR head (github.event.pull_request.head.sha/ref, github.head_ref, refs/pull/*) and building it lets any fork author execute code with those privileges ('pwn request'). The audit flags workflow files that use pull_request_target and reference the PR head anywhere; review flagged files manually.

점검 방법

감사 방식: 셸 명령

shell

top=$(git rev-parse --show-toplevel 2>/dev/null) || exit 1
cd "$top" || exit 1
wf=$(git ls-files -- '.github/workflows/*.yml' '.github/workflows/*.yaml' 2>/dev/null) || exit 1
bad=$(printf '%s\n' "$wf" | while IFS= read -r f; do
  [ -n "$f" ] || continue
  if grep -qE '^[^#]*pull_request_target' "$f" &&
     grep -qE '^[^#]*(github\.event\.pull_request\.head\.(sha|ref|repo)|github\.event\.pull_request\.merge_commit_sha|github\.head_ref|refs/pull/)' "$f"; then
    echo "$f"
  fi
done)
if [ -z "$bad" ]; then echo compliant; else echo "pull_request_target workflows that reference the untrusted PR head:"; printf '%s\n' "$bad"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Switch the workflow to the pull_request trigger (no secrets, read-only token), or split it: build untrusted code under pull_request and upload artifacts, then process them in a separate workflow_run job that never executes PR code. If pull_request_target is unavoidable, do not check out the head ref and set permissions: read-all.

속성

운영 체제: 모두
태그: supply-chainbuild-pipelinegithub-actions
참고 자료: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - Build Pipelines - isolate untrusted code from pipeline secrets (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target supply-chain