H3-2025-0004¶

GitHub Actions Artifacts Credential Leakage

Description¶

Misconfigured Github Action workflows utilizing actions/checkout and actions/upload-artifact can inadvertently leak credentials to publicly accessible artifacts.

Impact¶

Remote attackers who can find these artifacts may be able to recover git credentials and gain access to the GitHub repository.

References¶

• Unit 42 Article
• MITRE ATT&CK Technique: T1552.001: Unsecured Credentials: Credentials In Files