Steal api key

[nahallacman]

What Is This?

This is a proof of concept showing how you don't need to exfiltrate data outside of GitHub to print a protected piece of information like an API key.

The Hack

In a pipeline, you can run code that uses environment secrets that may be sensitive. A good example of this might be an API key. By default the GitHub Actions environment prevents those keys from being printed in simple means like echo "$API_KEY", turning the output from the API key contents to ****.

To get around this, we can use workflow dispatch to receive data from one pipeline and display it in another. The workflow that is dispatched does not have the same environment as the original pipeline, meaning the dispatched workflow does not know that the API key is a secret and does not censor it when it is printed.

This is a way to be able to exfiltrate the API key into another pipeline, and print out the sensitive data in the GitHub Action output. This contrasts with the typical sort of hack where people exfiltrate the API key to another URL they own, something that might be caught by platform security monitoring and reveals the URL that the API key was sent to for further inspection by a CIS team.

Where Is The API Key Displayed?

It gets sent to the workflow dispatch receiver, which is a different pipeline. You can find the example of the run where the API Key was leaked here:
https://github.com/nahallacman/GitHubActionSecurityTesting/actions/runs/17478722657/job/49644654264

What Can I Do?

• TODO: I am not sure of the best way to defend against this specific attack yet.
• Use best practices as mentioned in ls / #3 to protect who can create PRs, create CI/CD code, etc.