GitHub Workflow Permissions Modified
Description
Detects when the default workflow permissions for the GITHUB_TOKEN are modified at the organization level. GitHub Actions workflows use GITHUB_TOKEN for authentication, and changing these permissions can either expand or restrict what workflows can do by default. Unauthorized modifications could allow attackers to escalate privileges in CI/CD pipelines, potentially leading to supply chain compromise through malicious workflow modifications, unauthorized code deployments, or exfiltration of secrets. This is particularly concerning as it affects all repositories in the organization unless overridden at the repository level.
Query · python
def rule(event):
return (
event.get("action") == "org.set_default_workflow_permissions"
and event.get("operation_type") == "modify"
)
def title(event):
return (
f"Workflow permission settings for GITHUB_TOKENs have been changed"
f" for your organization [{event.get('org')}]"
f" by user [{event.get('actor')}]"
)
Analyst notes
- Identify the actor who modified the workflow permissions by reviewing the alert details for the 'actor' and 'actor_id' fields.
- Verify the legitimacy of the change: - Contact the user to confirm they made this change intentionally - Check if there was a recent change request or ticket associated with this modification - Verify the user's current role and whether they should have organization admin privileges
- Review the permission change details: - Navigate to GitHub Organization Settings > Actions > General > Workflow permissions - Document the current permission level (Read and write permissions vs. Read repository contents and packages permissions) - Check if "Allow GitHub Actions to create and approve pull requests" is enabled
- Assess the security impact: - Determine if permissions were expanded (potentially dangerous) or restricted (potentially disruptive) - Review recent workflow runs across the organization for any suspicious activity - Check for any new or modified workflows that may have been added around the time of this change
- If unauthorized or suspicious: - Immediately revert the permissions to the previous secure state - Review GitHub audit logs for other suspicious activities by the same actor - Check for any workflows that executed between the permission change and reversion - Rotate any secrets that may have been exposed - Consider revoking the actor's admin privileges pending investigation - Review all recent commits and pull requests for signs of compromise
- Implement preventive measures: - Enable branch protection rules requiring reviews for workflow file changes - Implement the principle of least privilege for workflow permissions at the repository level - Consider using environment protection rules for sensitive deployments - Enable secret scanning and push protection - Document approved workflow permission settings in your security policies