Case 01: Dangerous Triggers (pull_request_target)

Case 01: Dangerous Triggers (pull_request_target) #

Target File #

Vulnerability Overview #

The pull_request_target trigger executes in the context of the PR’s base branch, granting write permissions and access to secrets. This workflow uses actions/checkout@v4 without specifying an explicit ref, and lacks any security mitigations (no permission restrictions, no label conditions, no environment protection). An attacker can execute code in a privileged context by submitting a malicious PR.

Attack Scenario #

  1. Attacker creates a PR from a forked repository containing malicious code
  2. The pull_request_target trigger fires the workflow
  3. No permission restrictions or label conditions → any PR triggers execution
  4. Write permissions + secrets access → repository tampering or secret exfiltration

sisakulint Detection Results #

Rules Triggered #

RuleSeverityDescription
dangerous-triggers-criticalCriticalpull_request_target used without security mitigations
permissionsHighNo explicit permissions block
artipackedMediumpersist-credentials: false not set
commit-shaHighAction not pinned to commit SHA
missing-timeout-minutesLowNo timeout configured

Detection Message #

PRTargetWorkflow.yml:4:3: dangerous trigger (critical): workflow uses privileged trigger(s)
[pull_request_target] without any security mitigations. These triggers grant write access and
secrets access to potentially untrusted code. Add at least one mitigation: restrict permissions
(permissions: read-all or permissions: {}), use environment protection, add label conditions,
or check github.actor. [dangerous-triggers-critical]
  • Add permissions: {} to enforce least privilege
  • Add label conditions (if: github.event.label.name == 'safe-to-test')
  • Use environment protection rules
  • Specify explicit ref for checkout

Verdict: DETECTED #