Hi [...],

We’re writing to let you know that an independent bug bounty researcher recently reported a GitHub Actions bug that, in theory, could have allowed an unauthorized user to fork a public repository which uses Actions and perform a series of steps to edit the main branch or use the GITHUB_TOKEN to perform other unauthorized actions. This bug existed in a very brief window from February 4 to February 5, 2021.

You are receiving this email because you are an owner of one or more GitHub organizations or enterprises with a public repository using Actions, and you had protected and/or unprotected branches that were vulnerable to this bug.

Repos and workflows with unprotected branches: [...]

Repos and workflows with protected branches: [...]

There is currently no evidence to suggest this was the result of a compromise of GitHub or any of its systems; instead this was a recently introduced bug in GitHub Actions. Security, user privacy, and transparency are essential to maintain your trust; therefore, we are notifying you of this change, the steps we took, and additional steps we are taking to address this situation. Read on for more information.

* What happened? *

On February 4, 2021, an independent security researcher notified us of a bug in GitHub Actions that could allow an attacker to alter parent repository code or take certain actions using a GITHUB_TOKEN:  https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token

The GITHUB_TOKEN is revoked after the job is completed, and they expire after a default 60 minute timeout.

* Which repositories were involved? *

Any parent repository with Actions between February 4, 2021 at 18:42 UTC and February 5, 2021 at 13:35 UTC could have had their unprotected main branches edited or experienced misuse of the GITHUB_TOKEN.

* What GitHub is doing *

After learning of this bug on February 5, 2021, GitHub immediately corrected it, and unauthorized users could no longer make changes to your repositories or abuse the GITHUB_TOKEN. GitHub identified any repositories vulnerable during the bug window and contacted all affected organization owners. We are also performing an internal assessment to determine how we can better prevent this sort of bug in the future.

* What you can do *

For repositories listed above without branch protection, we recommend that you audit for both unwanted pull requests and abuse by the GITHUB_TOKEN.

1. Assess commits made during the bug window, February 4,2021 18:42 UTC to February 5, 2021 13:35 UTC.
2. Assess workflow files for unauthorized injection during the bug window.
3. Assess pull_request_target and pull_request workflow runs, and examine those pull requests during the bug window to look for unauthorized activity. Ignore pull requests from known users with write permissions.
4. Assess release history for any that may have been deployed via unauthorized GITHUB_TOKEN activity during the bug window.
5. Assess package history for any that may have been deployed via unauthorized GITHUB_TOKEN activity during the bug window.

For repositories listed above with branch protection, we recommend that you audit for abuse by the GITHUB_TOKEN.

1. Assess release history for any that may have been deployed via unauthorized GITHUB_TOKEN activity during the bug window.
2. Assess package history for any that may have been deployed via unauthorized GITHUB_TOKEN activity during the bug window.

Feel free to reach out to us with any additional questions or concerns through this contact form: [...]

Thanks,
GitHub Support