OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
Stay tuned... https://signal.org/security/
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
I have a feeling CVE-2025-30066 could have been prevented if the "tj-actions/changed-files" had the repository tag protection setting and the stolen PAT wasn't overprivileged.
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
Microsoft Edge is missing an opportunity here. Just keep V2 manifest support and get all uBlock Origin
users fleeing Chrome
https://news.ycombinator.com/item?id=43201974
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
I’ve released a new version of the GitHub Actions Permissions monitor. Say goodbye to the annoying “certificate validation” errors of the previous version! Quick info on how it works and what’s new.
The monitor action (https://gh.io/actions-permissions) installs a local @mitmproxy@bird.makeup in the actions runner. During a regular run the proxy intercepts outgoing requests looking for the GITHUB_TOKEN and maps the requests to the permissions required to these operations.
This allows you to identify the actually used permissions from multiple runs and restrict your GitHub actions usage to the minimal required permissions.
In order to intercept the traffic, the monitor uses a self signed certificate. Some programs use their own certificate stores and don't recognize the certificate, causing “certificate validation” errors. I was fixing it case by case, but it reminded me of a whack-a-mole game.
The new version uses the `allow_host` feature of @mitmproxy@bird.makeup to inject only the requests to GitHub. Actions usually use Curl, JavaScript or GitHub CLI to call GitHub API. These scenarios work well with the custom certificate.
So the permissions monitor is more precise and reliable now, intercepting only GitHub API requests to help you set your permissions correctly. Please give it a try to make your workflows more secure!
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
Youtube-dl and yt-dlp arbitrary file write when downloading video from attacker's site. It is a weird case when the same CVE-2024-38519 was assigned to similar but different apps. Well, it is me to blame in the first place to tune the PoC to work on both of them... https://securitylab.github.com/advisories/GHSL-2024-089_youtube-dl/
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
It makes me sad as I am Notepad++ user myself. https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
I made a thing... or two. GitHub Actions permissions Monitor and Advisor: #GitHubActions #security
OpenAI (Open-source Application Insecurity) Researcher at GitHub Security Lab. Opinions are my own. Russian warship go http://f.ck yourself.
I am glad to share that CVE-2022-23529 has been withdrawn - there is no room to escape if the attacker already controls the object in memory, even in the latest version of jsonwebtoken library: