GITHUB ACTIONS EXPLOITATION: DEPENDABOT

Summary from the TLDR InfoSec newsletter

Synacktiv discovered a novel GitHub Actions exploitation technique leveraging Dependabot to compromise repositories and push arbitrary code. The vulnerability stems from workflows using the 'pull_request_target' event with weak access controls based on the 'github.actor' context, which can be manipulated by triggering Dependabot actions on a forked repository. Synacktiv demonstrated successful exploits against the spring-security and trpc projects, highlighting the importance of careful workflow configuration and the use of tools like octoscan for detecting such vulnerabilities.