Описание
A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform (GCP) Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without sufficient authorization checks, an attacker could gain highly privileged access to GitHub and cloud resources, potentially leading to unauthorized control.
Отчет
Important: The operator-foundry component in Konflux is susceptible to an issue where overly broad GitHub Actions workflow permissions and GCP Workload Identity Federation credentials can be exposed to untrusted external actors. This misconfiguration allows an attacker to obtain highly privileged GitHub tokens and cloud credentials, potentially compromising the CI/CD pipeline and associated cloud resources.
Меры по смягчению последствий
To mitigate this vulnerability, restrict GitHub Actions workflow permissions by moving broad permissions: blocks from the workflow level to specific jobs, pruning them to the minimum required. Pin third-party reusable workflows to a full 40-character commit SHA instead of a version tag. Implement author-association checks (OWNER/MEMBER/COLLABORATOR) or maintainer-applied labels for jobs triggered by untrusted events (e.g., pull_request_target, issue_comment) that receive id-token: write or repository secrets. Additionally, configure the GCP Workload Identity Federation provider's attribute condition to only accept tokens from protected-branch workflow runs.
Дополнительная информация
Статус:
8.7 High
CVSS3
8.7 High
CVSS3