writeups.xyz / Stealing GitHub staff's access token via GitHub Actions

Submitter : c2a

Date: 22 April 2023

Bounty : undisclosed

Vulnerabilities :

• CI/CD
• Token Leak
• Privilege Escalation
• Supply Chain Attack

Programs :

• GitHub

Authors :

• RyotaK (@Ryotkak)

Link :
https://blog.ryotak.net/post/github-actions-staff-access-token-en/