Site deploy can run an unreviewed commit's build configuration with the deploy credentials

Site deploy can run an unreviewed commit's build configuration with the deploy credentials

Published as security advisory GHSA-mv97-mfm5-r2wh; the advisory is the public account of this finding.

abcd's site workflow, as scaffolded by abcd site setup and as used by abcd's own repository, deploys the site from a published release tag. The deploy job checks out the tag's commit and runs the hosting provider's deploy tool with the deploy credentials in reach, so the tool reads its configuration from that commit, including any build command. The workflow doesn't check that the tag's commit is on the default branch. In addition, the deployment environments abcd site setup creates admit every v* tag.

Impact: an account with push access to the repository, or a stolen token for one, can tag and publish a commit that never went through review or the merge queue, have it deployed, and run code of its own with the deploy credentials. Severity is rated high: the attack needs write access, but it reaches a production secret that the protected environment exists to fence off from writers.

Fix: the workflow refuses a release tag whose commit is not an ancestor of the default branch, and the deploy takes its host configuration from the default branch, never from the tag. abcd site setup admits only the default branch on the environments it creates. On an existing environment, setup reports a leftover v* rule and asks the person to remove it; it never rewrites an environment.

Workaround until the fixed release: remove the v* tag rule from the site and site-render environments, restrict who may create v* tags, and review the release tags already published.