🎯 New Report #3619288: RCE PAT Exfiltration via pull request target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers
🔺Severity: Critical
👽 Reporter: 6r1ff1n
⭐️ Reputation: 94
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-06-11 14:30:26
📝 Summary: A vulnerability was discovered in the "auto-respond-pr.yml" GitHub Actions workflow of the "privacy-configuration" repository. The workflow used the "pull request target" trigger, which checked out the fork's repository as both the "base" and "PR" branches. This allowed an attacker to control the code executed by the workflow, leading to arbitrary code execution and the exposure of the "PRIVACY CONFIG PAT" secret. The exposed token was likely used for PR auto-approval, enabling the attacker to approve their own PRs and access private repository contents. The vulnerability also resulted in the unconditional exposure of additional secrets, such as "ASANA ACCESS TOKEN" and "GH RO PAT", when a fork PR was closed.
📂 Report JSON File: 3619288
@hackeronereports