writeups.xyz / Github Actions Exploitation: Dependabot

Submitter : c2a

Date: 6 August 2024

Bounty : undisclosed

Vulnerabilities :

• CI/CD
• Arbitrary Code Push
• Security Code Review

Programs :

• Spring
• TRPC

Authors :

• Hugo Vincent (@Hugow_vincent)

Link :
https://www.synacktiv.com/publications/github-actions-exploitation-dependabot