writeups.xyz / The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree

Submitter : c2a

Date: 14 September 2023

Bounty : undisclosed

Vulnerabilities :

• CI/CD

Programs :

• Veracode
• Hangfire

Authors :

• Asi Greenholts (@TupleType)

Link :
https://www.paloaltonetworks.com/blog/prisma-cloud/github-actions-worm-dependencies/