论文标题
自动安全评估GitHub操作工作流程
Automatic Security Assessment of GitHub Actions Workflows
论文作者
论文摘要
对快速可靠的DevOps操作的需求推动了存储库平台的分销商来实施工作流程。工作流程允许直接在托管软件的存储库上自动化代码管理操作。但是，此功能还引入了直接影响存储库，其内容以及所有涉及托管代码的软件供应链的安全问题。因此，利用脆弱工作流程的攻击会影响大型软件生态系统。为了凭经验评估该问题的重要性，在本文中，我们关注事实上的主要分销商（即GitHub），并为GitHub Actions Workfrows开发了一种安全评估方法，这些方法在软件供应链中广泛采用。我们在工具（GHAST）中实施了该方法，并将其应用于50个开源项目。实验结果令人担忧，因为他们允许确定总共24,905个安全问题（全部报告给相应的利益相关者），从而表明该问题是开放的，需要进一步的研究和调查。
The demand for quick and reliable DevOps operations pushed distributors of repository platforms to implement workflows. Workflows allow automating code management operations directly on the repository hosting the software. However, this feature also introduces security issues that directly affect the repository, its content, and all the software supply chains in which the hosted code is involved in. Hence, an attack exploiting vulnerable workflows can affect disruptively large software ecosystems. To empirically assess the importance of this problem, in this paper, we focus on the de-facto main distributor (i.e., GitHub), and we developed a security assessment methodology for GitHub Actions workflows, which are widely adopted in software supply chains. We implemented the methodology in a tool (GHAST) and applied it on 50 open-source projects. The experimental results are worrisome as they allowed identifying a total of 24,905 security issues (all reported to the corresponding stakeholders), thereby indicating that the problem is open and demands further research and investigation.
