In this talk, we introduce a powerful tool that we developed for performing large-scale scanning of GitHub repositories, aimed at identifying expression injection vulnerabilities within workflow files. The motivation for this project arose from an incident where a client was exploited by a white-hat hacker who leveraged such a vulnerability to patch it through exploitation. This incident highlighted the prevalence and potential severity of expression injection in GitHub workflows, where attackers can inject malicious code through interpolated GitHub variables. This type of vulnerability can lead to the unauthorised exposure of sensitive information, such as the highly privileged GITHUB_TOKEN.

Our tool is designed to efficiently scrape repositories, interacting with the GitHub API to concurrently pull and analyse workflow configuration files. By parsing these YAML files and detecting insecure patterns, we were able to uncover a surprising prevalence of expression injection vulnerabilities across a wide range of repositories, including some of the most popular open-source projects. Through the process of continuous mining, our system adheres to GitHub's rate limits, allowing it to run in the background without overwhelming the platform.

A key aspect of our findings is that even when these vulnerabilities are patched, they are often reintroduced through seemingly benign changes, such as interpolating sanitized values back into workflows. This creates a cyclical security risk that many teams may not even realise. We observed that existing mitigations, such as restricting permissions for each step and cautiously using the env directive to safely insert GitHub variables, are not prioritised in the documentation and inadequately enforced in real-world projects.

Written entirely in Scala, our application serves as a robust scanner that not only parses and identifies risky patterns but, allows for an interactive review process of the findings. Through this ongoing effort, we hope to drive awareness around this often-overlooked class of security issues in CI/CD pipelines. Additionally, we have made this tool open-source, allowing both blue team (defensive) and red team (offensive) security researchers to benefit from it.

Key Takeaways:

• Expression injection vulnerabilities in GitHub workflows are more common than previously thought, even in widely used repositories.
• Attackers can exploit this vulnerability to extract privileged data like the GITHUB_TOKEN, leading to further compromise.
• Patching vulnerabilities is not always enough—reintroductions of sanitised values can recreate the problem.
• Proper mitigations, such as limiting permissions and safely handling GitHub variables, require more comprehensive documentation and awareness.
• Our tool, written in Scala, interfaces with the GitHub API and is capable of continuous background mining while adhering to API rate limits.
• We are open-sourcing this tool to promote better security practices and aid both security researchers and developers in safeguarding their workflows.