Summary
Filecoin Pin's upload GitHub Action may fail to recognize pull requests from forked repositories when processing a privileged workflow_run event. An external contributor could then cause an attacker-controlled artifact to be uploaded using the repository owner's Filecoin wallet, potentially consuming funds and polluting stored datasets.
Filecoin Pin's upload GitHub Action may fail to recognize pull requests from forked repositories when processing a privileged workflow_run event. An external contributor could then cause an attacker-controlled artifact to be uploaded using the repository owner's Filecoin wallet, potentially consuming funds and polluting stored datasets.
Affected context
The issue occurs in deployments using Filecoin Pin's documented two-workflow GitHub Actions pattern, where an untrusted pull-request workflow creates an artifact and a privileged workflow_run workflow later downloads and uploads it. The risk is present when fork detection relies only on pull-request event fields that are not populated in the workflow_run context, allowing the artifact upload path to proceed with repository-owned wallet credentials.
The issue occurs in deployments using Filecoin Pin's documented two-workflow GitHub Actions pattern, where an untrusted pull-request workflow creates an artifact and a privileged workflow_run workflow later downloads and uploads it. The risk is present when fork detection relies only on pull-request event fields that are not populated in the workflow_run context, allowing the artifact upload path to proceed with repository-owned wallet credentials.
Exploit preconditions
- Attack surface: GitHub Actions workflow automation using the upload action
- Required access: Ability to submit or update a pull request from an external fork
- Trigger point: The privileged workflow_run job processing the artifact from the untrusted workflow
- Why exploitation is possible: Fork status is not revalidated in the workflow_run context before wallet initialization and artifact upload
- Credential requirement: The attacker does not need access to or disclosure of the repository's wallet private key
- Attack surface: GitHub Actions workflow automation using the upload action
- Required access: Ability to submit or update a pull request from an external fork
- Trigger point: The privileged workflow_run job processing the artifact from the untrusted workflow
- Why exploitation is possible: Fork status is not revalidated in the workflow_run context before wallet initialization and artifact upload
- Credential requirement: The attacker does not need access to or disclosure of the repository's wallet private key
Why this happens
The action performs authorization logic using event-specific data that is available for pull_request events but absent from workflow_run events. As a result, a fork-origin check can incorrectly evaluate as safe, and the later privileged operation trusts an artifact produced by an untrusted workflow. This maps to CWE-863, Improper Authorization, because the action does not consistently enforce the required trust boundary before using repository-owned resources.
The action performs authorization logic using event-specific data that is available for pull_request events but absent from workflow_run events. As a result, a fork-origin check can incorrectly evaluate as safe, and the later privileged operation trusts an artifact produced by an untrusted workflow. This maps to CWE-863, Improper Authorization, because the action does not consistently enforce the required trust boundary before using repository-owned resources.
Potential impact
- An attacker-controlled artifact may be stored through the repository's Filecoin account
- Configured wallet funds could be consumed without repository-owner approval
- Stored datasets may be polluted with unauthorized or malicious content
- Automated storage costs could increase unexpectedly
- Downstream consumers may process or rely on untrusted pinned data
- An attacker-controlled artifact may be stored through the repository's Filecoin account
- Configured wallet funds could be consumed without repository-owner approval
- Stored datasets may be polluted with unauthorized or malicious content
- Automated storage costs could increase unexpectedly
- Downstream consumers may process or rely on untrusted pinned data
General mitigation guidance
Mitigation generally focuses on enforcing authorization consistently across
every workflow event and treating artifacts from fork-based workflows as
untrusted.
Common defensive patterns include:
- Repeating fork and repository-origin checks immediately before privileged uploads
- Binding authorization decisions to trusted workflow and commit metadata
- Separating untrusted artifact production from credentialed upload operations
- Requiring explicit approval or policy checks before consuming external artifacts
- Limiting wallet permissions, spending capacity, and workflow token privileges
- Using isolated accounts or environments for automated uploads
- Avoiding exposure of wallet credentials to jobs that process untrusted content
Mitigation generally focuses on enforcing authorization consistently across
every workflow event and treating artifacts from fork-based workflows as
untrusted.
Common defensive patterns include:
- Repeating fork and repository-origin checks immediately before privileged uploads
- Binding authorization decisions to trusted workflow and commit metadata
- Separating untrusted artifact production from credentialed upload operations
- Requiring explicit approval or policy checks before consuming external artifacts
- Limiting wallet permissions, spending capacity, and workflow token privileges
- Using isolated accounts or environments for automated uploads
- Avoiding exposure of wallet credentials to jobs that process untrusted content
How teams detect issues like this
Organizations can identify similar authorization flaws through:
- Static analysis checks for event-specific fields used as universal trust signals
- Code review of workflow_run jobs that download artifacts from pull requests
- Rules requiring origin, repository, workflow, and commit validation before privileged actions
- Policy checks that flag credentials used in jobs processing fork-generated artifacts
- Monitoring for unexpected wallet spending, upload volume, or artifact provenance
- Automated security review tools that model GitHub Actions event and permission boundaries
Organizations can identify similar authorization flaws through:
- Static analysis checks for event-specific fields used as universal trust signals
- Code review of workflow_run jobs that download artifacts from pull requests
- Rules requiring origin, repository, workflow, and commit validation before privileged actions
- Policy checks that flag credentials used in jobs processing fork-generated artifacts
- Monitoring for unexpected wallet spending, upload volume, or artifact provenance
- Automated security review tools that model GitHub Actions event and permission boundaries
