chylli-deriv / pull-request-target-vuln-v2

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Pull Request Target Event

NOTE: This is an extreme case just for POC purposes

  1. To test it out, fork the repository
  2. Modify test.sh, commit it and create a pull request
  3. Navigate back to this repository, and a github action would be triggered
  4. Below bash script, can be used get the base repository secret
#!/bin/bash

env | grep "super_secret"
  1. Expected output, super_secret=*** the *** indicates that workflow is able to access the base repo secret image

About


Languages

Language:Shell 100.0%