Researchers show leaked GitHub tokens can be used before they expire

A credential that expires quickly is not the same as a credential that is safe. A speaker on the OWASP Foundation show argued this in a talk about stealing GitHub tokens from Docker images. The recording does not name the speakers. Their point was that attackers can use a leaked token before it expires.

What was said

GitHub gives each automated build job, called a workflow, a token that expires when the workflow ends. So an attacker has to use a leaked token before the job finishes. The speaker called this a race condition and said whether an attacker wins depends on the workflow.

The job may keep working after the leak. It might build a second image or deploy to production, which the speaker said could take a minute, two or three. Even a job with nothing left to do runs cleanup steps at the end. In two example workflows, cleanup alone kept the token valid for 13 and 16 seconds. The speaker called that enough to exploit a leaked token.

The leak comes from a Dockerfile that copies the whole project folder into the image. The demo showed an attacker pulling the image from Docker Hub and finding a token inside. The speaker said the researchers' own pipeline finds and tests tokens, and "we win it without even really trying."

The speaker gave these figures from the team's checks. About 24% of leaked tokens can at least read a repository, including private ones. About 2% can push code, which the speaker put at roughly 700 tokens a month. Leaks were still close to 40,000 a month.

Why it matters

Our reading: a short expiry is a delay, not a defence, once the attacker is a script that never sleeps. Treat any leaked token as a breach, whatever its lifetime. If you run build pipelines, the fixes the speakers named are cheap. Update the checkout action. Skip the checkout step when the Docker build action can fetch the code itself. Use a Docker ignore file so that Git data and environment files stay out of images. Also remember that a leak can expose private code even when no secret leaks.

The other side

Expiry still helps, and the speaker did not say otherwise. A job with little cleanup leaves a shorter window. Most leaked tokens in the speaker's data could not push code at all. The researchers tested tokens only by trying to clone and push "not for real", so the talk does not show how often real attackers win.

The talk reported a 20% fall in monthly leaks since the start of the year. It also reported about 5,000 new leaking repositories each month, a number the speaker called increasing. The excerpts do not explain the fall.