Unit 42: open-source projects from Google, Microsoft, AWS, Red Hat, and others leaked GitHub auth tokens via GitHub Actions; GitHub chose not to fix the issues
Multiple high-profile open-source projects, including those from Google, Microsoft, AWS, and Red Hat, were found …
7/ Major projects affected: Google's firebase-js-sdk (1.6M+ dependents!) Ubuntu's adsys Projects by Microsoft, Red Hat, AWS, OWASP, and more Full list in the blog post!
3/ I discovered two types of exposed tokens: * GITHUB_TOKEN (prefix: ghs_) * ACTIONS_RUNTIME_TOKEN (a JWT) These weren't in the code, but in artifacts produced by workflows.
🚨 Flaw in GitHub Action Artifacts Expose Sensitive Tokens The research highlights a security flaw in GitHub Actions artifacts, which can leak sensitive tokens, including GitHub tokens and third-party cloud service tokens. Here is what you need to know: 🧵 [image]