Vulnerabilities and Misconfigurations in GitHub Actions - Rojan Rijal

GitHub Actions has helped companies automate their CI/CD pipeline with ease by directly integrating with their code sources. This ease however can come with pain when various vulnerabilities arise due to misconfigurations, code vulnerabilities and supply-chain attack vectors.

This talk will cover three different vulnerability types in GitHub Actions. We’ll go over basic code execution examples due to unsanitized user inputs, and two unique vulnerabilities seen by us. The first vulnerability will cover a supply chain attack by exploiting vulnerable …

actions attack attack vectors cd pipeline code code vulnerabilities companies github github actions misconfigurations pipeline supply types vulnerabilities vulnerability