HIJACKING GITHUB RUNNERS TO COMPROMISE THE ORGANIZATION

Summary from the TLDR InfoSec newsletter

This article discusses a novel attack technique that utilizes developer access to a lower privilege GitHub repository to escalate privileges to a total compromise of all GitHub Actions pipelines in the organization. The attack makes use of a command injection vulnerability caused by utilizing the branch name directly in a command run on a self-hosted runner. This access is then used to register a new runner with the ubuntu-latest tag that will be used for any actions trying to use the GitHub hosted ubuntu-latest runner.