René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security: Branch name injection in `pr-auto-commit.yaml` — actively exploited by hackerbot-claw","articleBody":"## Summary\n\nThe `pr-auto-commit.yaml` workflow is vulnerable to **shell command injection via branch names**. The `${{ github.event.pull_request.head.ref }}` expression is interpolated directly into `run:` blocks without sanitization, allowing an attacker to execute arbitrary commands on the GitHub Actions runner with access to repository secrets (including `AUTO_COMMIT_PAT`).\n\n**This vulnerability has already been exploited.** On March 2, 2026, the account [`hackerbot-claw`](https://github.com/hackerbot-claw) — an autonomous bot that has been [attacking CI/CD pipelines across major open source projects](https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation) — opened two PRs ([#7308](https://github.com/RustPython/RustPython/pull/7308), [#7309](https://github.com/RustPython/RustPython/pull/7309)) with a malicious branch name designed to trigger code execution. The payload partially executed on the CI runner but failed due to a base64 encoding issue — not because of any security control.\n\n## Vulnerable Code\n\n**File:** `.github/workflows/pr-auto-commit.yaml`\n\n**Primary injection point — \"Push formatting changes\" step (line ~97):**\n\n```yaml\n- name: Push formatting changes\n  if: steps.check-changes.outputs.has_changes == 'true'\n  run: |\n    git push origin HEAD:${{ github.event.pull_request.head.ref }}\n```\n\n**Secondary injection point — \"Comment on PR\" step (line ~119):**\n\n```yaml\ngit pull origin ${{ github.event.pull_request.head.ref }}\n```\n\nBecause the workflow uses `pull_request_target`, it runs in the context of the base repository with access to secrets and write permissions. The attacker controls the branch name (`head.ref`) via their fork.\n\n### Evidence from workflow runs\n\n- **[Run 22563211110](https://github.com/RustPython/RustPython/actions/runs/22563211110)** (PR #7308): The injection step was **skipped** because `has_changes` was `false` — the trivial change to `bench.sh` didn't trigger formatting differences.\n\n- **[Run 22563415110](https://github.com/RustPython/RustPython/actions/runs/22563415110)** (PR #7309): The injection step **executed**. The build log shows `base64: invalid input`, confirming the shell evaluated the command substitution. The full payload failed due to an encoding issue in the branch name, but the `base64 -d` command did run on the runner.\n\n## Impact\n\nIf the payload had succeeded, the attacker would have had access to:\n\n- **`AUTO_COMMIT_PAT`** — a Personal Access Token available as a secret in this workflow, which could be used to push commits, modify code, or potentially take over the repository (similar to [what happened to aquasecurity/trivy](https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#attack-6-aquasecuritytrivy--full-repository-compromise) in the same campaign)\n- **`GITHUB_TOKEN`** with `contents: write` and `pull-requests: write` permissions\n\n## Context\n\nhttps://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation\n","author":{"url":"https://github.com/varunsh-coder","@type":"Person","name":"varunsh-coder"},"datePublished":"2026-03-02T06:43:37.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":7},"url":"https://github.com/7311/RustPython/issues/7311"}