Compromising (Almost) Every Repo Using CodeQL: A Supply Chain Attack

A recent supply chain vulnerability discovered by John Stawinski of Praetorian exposed a critical flaw in GitHub’s CodeQL, allowing attackers to execute malicious code in GitHub Actions workflows across numerous repositories. The issue stemmed from a GitHub token exposed in a workflow artifact, valid for just 1.022 seconds, which, if stolen, could enable attackers to create malicious branches and tags in the CodeQL repository.

Impact of the Exploit

Exfiltration of private source code
Theft of GitHub Actions secrets
Execution of arbitrary code on internal infrastructure (for self-hosted runners)
Widespread supply chain compromise

You Should Know: Exploitation & Mitigation Steps

1. Understanding the Vulnerability

The CodeQL Action inadvertently exposed a short-lived GitHub token in workflow artifacts. Attackers could intercept this token and abuse it to push malicious changes.

2. Detection & Prevention

To check if your repos are affected:

 List all workflows using CodeQL 
gh workflow list | grep "codeql"

Inspect workflow artifacts for exposed tokens 
gh run download <run-id> --artifact-name=logs 
grep -r "token" ./

3. Securing GitHub Actions

Restrict workflow permissions:

permissions:
contents: read 
secrets: none

Use OIDC for cloud auth instead of long-lived secrets:
```
permissions:
id-token: write 
```
Enable required approvals for external contributors:
```
gh repo edit <repo> --enable-approvals 
```

4. Monitoring for Suspicious Activity

 Audit GitHub logs for unauthorized branch/tag creation 
gh api /repos/{owner}/{repo}/events | jq '.[] | select(.type == "CreateEvent")'

5. Revoking Compromised Tokens

If exposure is suspected:

gh auth revoke --hostname github.com

What Undercode Say

This exploit highlights the fragility of CI/CD pipelines and the risks of short-lived credential exposure. Key takeaways:
– Least privilege is critical—limit token scopes.
– Artifact inspection should be automated to detect leaks.
– Self-hosted runners must be isolated from sensitive networks.
– Real-time monitoring for anomalous workflow behavior is essential.