writeups.xyz / From Self-Hosted GitHub Runner to Self-Hosted Backdoor

Submitter : c2a

Date: 26 October 2022

Bounty : undisclosed

Vulnerabilities :

• CI/CD
• Lateral Movement
• Post-Exploitation

Programs :

• GitHub

Authors :

• Adnan Khan (@Adnanthekhan)
• Mason Davis
• Matt Jackoski

Link :
https://www.praetorian.com/blog/self-hosted-github-runners-are-backdoors/