The Dark Playground of CI/CD: Attack Delivery by GitHub Actions

Two offensive security researchers from a Japanese telecommunications company examine how GitHub Actions, the CI/CD automation feature built into GitHub, can become an attack surface. Build pipelines are convenient for developers, but the same runner and custom action mechanisms can give an attacker code execution inside a trusted workflow. The speakers separate techniques already seen in the wild from ones their own research found.

The middle of the talk covers the attack techniques they developed. A JavaScript custom action runs through the runner's bundled Node engine, and by swapping that binary for a Windows script host, a JScript payload runs in its place. Wrapping the steps in a composite action lets the malicious action run without a visible setup step. A JavaScript variant abuses a Node module that opens processes and injects DLLs. They also described a command-and-control channel built on the runner application itself, which polls GitHub for jobs, so its traffic to a legitimate domain blends into normal activity. A short demo showed a remote connection set up this way. The talk also reviewed free-jacking of compute resources, malicious pull requests against public repositories that use self-hosted runners, and theft of repository secrets.

For defenders, the speakers said that code review of actions and their publishers matters, and that antivirus is easy to evade with small edits, so detecting the behavior of the attack is more useful. In the Q&A, the speakers confirmed that secret theft works on both self-hosted and GitHub-hosted runners. The practical takeaway is to treat CI runners as untrusted execution environments.