Package: ghast-scanner
ghastGhast (GitHub Actions Static Analysis Tool) is a tool to analyze the security posture of your GitHub Actions and its surrounding environment for common security vulnerabilities and/or missing security configuration.  You can use Ghast as a stand-alone analysis tool via the Ghast CLI or by running Ghast as a native GitHub Action.The actions directory has some example GitHub Actions with vulnerable steps that you can use to test.Install the Ghast CLIMake sure you have$HOME/.local/binin your PATHUsing Pippip install ghast-scannerWith Git/Pythongit clone https://github.com/bin3xish477/ghast.git
python3 -m pip install .How to use the Ghast CLIghast -h 					# get help 
ghast --file action.yml 			# scan a specific workflow file
ghast -d directory-with-actions/ --verbose	# scan a directory in verbose mode
ghast --file action.yml --ignore-warnings	# scan a specific workflow file and ignore warnings
ghast --list-checks				# list all known checks
ghast -i check_for_inline_script --no-summary	# only run a specific check and don't show tool summarySee how the Ghast CLI worksUseghastin Your GitHub WorkflowsDefault Workflowname:'RunGhast'on:push:jobs:RunGhast:runs-on:ubuntu-lateststeps:-name:"Checkoutrepo"uses:actions/checkout@96f53100ba2a5449eb71d2e6604bbcd94b9449b5# v3.5.3-name:"RunGhast"uses:"bin3xish477/ghast@43c471b8e05599d67f618ecccfc8d7b9281bfd9b"See Additional Workflow ExamplesAdditional Ghast Workflow ExamplesChecks Performed byghastName:check_for_3p_actions_without_hash, Level:FAILThis check identifies any third party GitHub Actions in use that have been referenced via a version number such asv1.1instead of commit SHA haah. Using a hash can help mitigate supply chain threats in a scenario where a threat actor has compromised the source repository where the 3P action lives.Name:check_for_allow_unsecure_commands, Level:FAILThis check looks for the usage of environment variable calledACTIONS_ALLOW_UNSECURE_COMMANDSwhich allows for an Action to get access to dangerous commands (get-env,add-path) which can lead to code injection and credential thefts opportunities.Name:check_for_cache_action, Level:WARNThis check finds any usage of GitHub's caching Action (actions/cache) which may result in sensitive information disclosure or cache poisoning.Name:check_for_dangerous_write_permissions, Level:FAILThis check looks for write permissions granted to potentially dangerous scopes such as thecontentsscope which may allow an adversary write code into the target repository if they're able to compromise the workflow. It's also looks for usage of thewrite-allwhich gives the action complete write access to all scopes.Name:check_for_inline_script, Level:WARNThis check simply warns that you're using an inline script instead of GitHub Action. Inline scripts are susceptible to script injection attacks (another check covered byghast). It is recommended to write an action and pass any required context values as inputs to that action which removes script injection vector because action input are properly treated as arguments and are not evaluated as part of a script.Name:check_for_pull_request_target, Level:FAILThis check looks for the usage of the dangerous event triggerpull_request_targetwhich allows workflow executions to run in the context of the repository that defines the workflow, not the repository that the pull request originated from, potentially allowing a threat actor to gain access to a repositories sensitive secrets!Name:check_for_script_injection, Level:FAILThis check looks for the most commonly known security risk to GitHub Action - script injection. Script injection occurs when an action directly includes (using the${{ ... }}syntax) a GitHub Context variable(s) in an inline script that can be controlled by an untrusted actor, resulting in command execution in the interpreted shell. These user-controllable parameters should be passed into an inline script as environment variables.Name:check_for_self_hosted_runners, Level:WARNThis checks attempts to identify the usage of self-hosted runners. Self-hosted runners are dangerous because if the Action is compromised it may allow a threat actor to gain access to on premise environment or establish persistence mechanisms on a server you own/rent.Name:check_for_aws_configure_credentials_non_oidc, Level:WARNThis checks looks for the usage of AWS'saws-actions/configure-aws-credentialsaction and attempts to identify non-OIDC authentication parameters. Non-OIDC authentication types are less secure than OIDC because they require the creation of long-term credentials which can be compromised, however, OIDC tokens are short-lived and are usually scoped to only the permissions that are essential to a workflow and thus help reduce the attack surface.Name:check_for_create_or_approve_pull_request, Level:WARNThis check looks for Action that have logic related to creating or improving pull requests. Creating or approving pull requests via automation poses a security risk if sufficient controls aren't in place to protect against malicious code being merged into a repository.Name:check_for_remote_script, Level:WARNThis check looks for a URL in an inline script of a GitHub Action which usually signals the inclusion of a remote script which can be dangerous.Name:check_for_upload_download_artifact_action, Level:WARNThis check is essential for identifying any usage of GitHub's upload/download artifact Action, as it can potentially expose your workflow to compromised files. For instance, an uploaded artifact might contain a compiled binary from a previous workflow, but this binary could be compromised due to the introduction of malicious dependencies during the compilation phase. Consequently, if this tainted binary is executed within another workflow, it could lead to significant security risks. To mitigate such risks, it is crucial for users to conduct integrity checks on artifacts before consumption. This check serves as a valuable reminder to reinforce this security practice.Name:check_for_non_github_managed_actions, Level:WARNThis check looks for inclusion of non GitHub-managed actions and serves as a reminder to review the security posture of any third party actions you include in your workflow(s), especially if they are not developed and maintained by credible entities.Auxiliary ChecksName:check_for_missing_codeowners_file- checks for missingCODEOWNERSfile.Name:check_for_missing_security_md_file- checks for missingSECURITY.mdfile.Name:check_for_missing_gitignore_file- check for missinggitignorefile.Name:check_for_missing_dockerignore_file- check for missingdockerignorefile.ReferencesSecurity hardening for GitHub Actions