88
See? I TOLD you all to leave GitHub! "Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks" (thehackernews.com)
submitted 3 months ago* by to c/linux@lemmy.ml
6 comments fedilink hide all child comments
 

Don't say I didn't warn you...

all 6 comments

sorted by: hot top controversial new old
[–] 27 points 3 months ago (4 children)

The core of the problem trickles down to weak CI/CD configurations that grant pull requests (PRs) more permissions than they should have.

How exactly do their competitors like codeberg do better in preventing that?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 5 points 3 months ago (2 children)

    The article doesn't seem to say. I don't know if it's a problem with defaults or caused by the devs themselves.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 3 months ago

    By default pull requests my new contributors require approval from someone with write-access to the repo before running actions.

    These repos have specifically decided to change a setting to make them not require approval for anyone. The UI to change that setting explicitly warns you about exactly this attack, so this "article" feels like a non-item trying to farm engagement.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 3 months ago

    I'm no expert in this but I'm guessing GH's higher tiers provide much more "actions" and whatnot than Codeberg does. AFAICS Gitlab might be the only alternative that even has the mechanisms that could be exploited.

    But executing code in a comment, that's harsh in any case. I mean, even I would've known how to prevent that right from the start. I think.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 10 points 3 months ago

    That sounds big & creepy:

    On Microsoft's Azure Sentinel, for example, Novee found a comment on a PR that could run anonymous attacker code on Microsoft's CI and steal a non-expiring GitHub App key.

    I wonder if/how alternative VCS platforms that provide similar workflow services are affected.

  • permalink
  • fedilink
  • source
    •