bin3xish477/ghast

GHAST (GitHub Actions Static Analysis Tool) is a tool to analyze the security posture of your GitHub Actions and its surrounding environment for common security vulnerabilities or missing security configuration.

👋🏻 Hello, World! 👋🏻

My name is Alex Rodriguez and I am an Offensive Security Engineer @Amazon.

At this moment

• I’m currently:
  • Writing cybersecurity/tech articles on my blog ✍🏻
  • Pentesting web apps hosted on AWS ☁️
  • Hunting for bugs 🕷️
  • Brainstorming blog/project ideas 🧠
  • Studying generative AI 🤖

ghast's Issues

having 'verbose: true' in workflow file means _check_for_inline_script will not display findings for inline scripts found

For some reason when you have the verbose: true parameter set in the ASA workflow file you will not see any findings for inline scripts found.

The way to test this yourself is create a GitHub Action Workflow file with a run: action and if you set the verbose: true parameter you will not see the notification for that finding. If you then remove the verbose: true from the workflow file you will then be able to see the workflow finding.

Please see analyzer/analyzer.py

    def _check_for_inline_script(self) -> bool:
        passed = True
        for job in self.jobs.keys():
            steps = self.jobs[job]["steps"]
            for step in steps:
                if "run" in step:
                    if self.verbose:
                        print(
                            f"{Colors.LIGHT_GRAY}INFO{Colors.END} found inline script in job('{job}').step('{step['name']}')"
                        )
                    passed = False
        return passed

_check_for_inline_script needs to do more than just grep for 'run'

First, let me say, I think this project is awesome and I want to help make it better if I can. :)

I'm creating this ticket as I wanted to have a discussion about how the ASA project identifies issues going forward. I thought about creating a PR and adding some code myself but wanted to have a conversation first.

I think the _check_for_inline_script function needs to be modified to do more than just check for the presence of 'run' in the action step. I understand that the GitHub Action hardening guide calls out inline scripts, but there needs to be a delineation between say a bash script is called from a remote location versus a run command that executes a binary in a specific action, like, say semgrep or npm. Right now, _check_for_inline_script will create a lot of false positives for many legitimate uses of the run action. Just take a look at the Semgrep Action: https://semgrep.dev/docs/semgrep-ci/sample-ci-configs/#sample-github-actions-configuration-file or the NPM Action: https://github.com/actions/setup-node. And there are thousands of others where the Action calls an executable inside the docker container that Action maps to.

tl;dr:
The use of 'run:' by itself should not be a finding, but if 'run:' calls a script or other insecure mechanism, then it should absolutely be a finding.

Let me know your thoughts.