GitHub Actions and Code Injection: Avoiding Vulnerable Configurations

GitHub Actions is an increasingly popular DevOps tool because of its rich marketplace and ease of use. As part of our research into the GitHub Actions security landscape, we discovered several pitfalls in the workflow that could result in severe security consequences. For example, we noticed many developers using event input data to improve their workflow process. In theory, this helps to streamline and simplify the workflow; in practice, however, this data could be controlled by an attacker and potentially compromise the build process. Unless developers deeply understand GitHub best practices, these workflows are likely to have mistakes that are costly and could create supply chain risk to the application.

In this webinar, we'll discuss how we found and disclosed vulnerable workflows in several popular open source tools, delve into GitHub Actions architecture to understand the possible consequences of these vulnerabilities, and present possible mitigations for these issues.

Alex Ilgayev

Senior Security Researcher, Cycode

Alex Ilgayev is a senior security researcher at Cycode where he focuses on securing software delivery pipelines. Prior to Cycode, Alex was the malware research team leader at Check Point. Alex began his career spending the better part of a decade as a software developer and security researcher in the Israel Defense Forces.

Webinar

Think About Your Audience Before Choosing a Webinar Title

What You’ll Learn in This Webinar

Register to Watch Now:

this webinar starts in

What You’ll Learn in This Webinar

About the Hosts