GitHub Tightens Security to Counter Pwn Request Attacks

GitHub has implemented new security measures for its actions/checkout tool, aiming to thwart 'pwn request' attacks that exploit the pull_request_target workflow trigger. The change, announced on June 18, sees actions/checkout v7 automatically block and fail workflows trying to fetch unreviewed fork pull request code within pull_request_target or workflow_run events. Developers can opt out by specifying an allow-unsafe-pr-checkout in their configurations.

This update marks GitHub's shift towards a 'secure by default' model, taking security controls out of developers' hands. By July 16, the new defaults will be applied to all supported versions, affecting workflows pinned to floating major tags, such as actions/checkout@v4. Workflows pinned to specific SHAs, minors, or patches will require manual upgrades.

The vulnerability in question arises from GitHub Actions workflows using the pull_request_target trigger. While this trigger is necessary for certain automations, its careless configuration with actions/checkout has been exploited by attackers to access repositories and their secrets. This loophole has been known for years but remained unaddressed until now.

The recent surge in attacks, including those by the TeamPCP hacking group, has highlighted the urgency for GitHub to act. TeamPCP's activities compromised 170 npm packages, such as the TanStack Router ecosystem, via pwn request exploits. GitHub itself also faced a security breach, leading to the exfiltration of source code from approximately 3,800 internal repositories.

GitHub's response includes broader security reforms, such as restricting automatic script execution in npm. While the changes may be overdue, they are a necessary step to safeguard developer environments.

Affected users should review their workflows and consider adopting the new security defaults. Those relying on specific versions must plan for necessary upgrades to maintain security.