Critical Vulnerabilities Uncovered in Open Source Projects – MITRE and Splunk Reveal Insecure GitHub Actions

Security researchers from the Sysdig Threat Research Team (TRT) have uncovered alarming vulnerabilities in widely used open source projects, including those maintained by industry giants MITRE and Splunk.

These security gaps stem from insecure configurations in GitHub Actions, specifically related to the misuse of the pull_request_target trigger.

GitHub Actions, a popular automation platform for continuous integration and deployment (CI/CD) pipelines, is now under scrutiny as a major attack vector for supply chain threats.

According to the Sysdig TRT, dozens of open source projects were found vulnerable due to workflows triggered by pull_request_target that checked out and executed untrusted code from forks.

These workflows, often used to test pull requests from external contributors, expose repository secrets and grant high-privileged access to the repository’s GITHUB_TOKEN, enabling attackers to execute malicious code and exfiltrate sensitive data.

The vulnerabilities were found not only in obscure repositories but also in high-profile projects with thousands of stars and active communities.

Case Studies: MITRE, Splunk, and Spotipy Under Threat

Among the prominent examples, the spotipy-dev/spotipy The repository, a popular Python library for the Spotify Web API, was found running a vulnerable workflow.

The workflow used pull_request_target to check out code from forks and execute pip install, which allowed malicious changes to the setup.py file to trigger arbitrary code execution.

Attackers could exfiltrate secrets and maintain persistent access by keeping the workflow alive.

Similarly, the MITRE CAR (Cyber Analytics Repository) was found to have a workflow activated by pull_request_target that checked out code from forks and installed dependencies via pip install -r requirements.txt.

This workflow, if exploited, provided attackers with high-privileged access to the repository and its secrets.

The Splunk security_content The repository also exhibited a critical misconfiguration. While the GITHUB_TOKEN was restricted to read-only access, two sensitive secrets (APPINSPECTUSERNAME and APPINSPECTPASSWORD) were exposed.

Although Splunk has since patched the workflow, the vulnerability highlighted the continued risks of sensitive data leakage.

Best Practices and Mitigation Strategies for Secure GitHub Actions

To safeguard open source projects from such attacks, the Sysdig TRT recommends strict security practices.

The primary recommendation is to avoid using pull_request_target unless its security implications are fully understood and mitigated.

If the trigger is necessary, workflows should be hardened to prevent execution of untrusted code and access to sensitive secrets.

Workflow splitting is highly recommended, where unprivileged workflows handle initial pull requests and privileged workflows are only triggered after manual review. 

Restricting GITHUB_TOKEN permissions to the minimum required and using runtime threat detection tools like Falco Actions can further enhance security.

Falco Actions can detect suspicious activities such as credential extraction and unauthorized data exfiltration, providing real-time alerts for malicious behavior.

Raising the Bar for Open Source Security

The discoveries by Sysdig TRT underscore the persistent risks faced by open-source projects using CI/CD pipelines.

The widespread misuse of GitHub Actions, especially pull_request_target, poses a significant threat to software supply chains.

By adopting robust security practices, limiting permissions, and leveraging monitoring tools, organizations can protect their repositories from exploitation.

Continuous education, proactive vulnerability hunting, and timely remediation are crucial for maintaining the integrity and trustworthiness of open-source software in the face of evolving threats.