Any organization member can create internal repositories

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_184
Category	IAM
Severity	LOW

Impact

All members of an organization have privileges to create internal repositories. If a member's account or access token is compromised, a malicious actor could create such a repository and access all of the organization's secrets scoped to private and internal repositories. For example, if the scope of a GitHub organization secret is not limited to specific repositories, any member of the organization can create an internal repository and configure a GitHub Actions workflow to retrieve the secret. In addition, internal repositories are accessible to any member in the enterprise, which could potentially allow unauthorized access to these repositories.

Recommended Solution - Buildtime

Disable the excessive permissions granted to all organization members to create private repositories.

To disable internal repository creation refer to https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization.

If the above mitigation is not possible, or in addition to it, it’s important to scope organization secrets to specific repositories and grant permission on a need-to-access basis only, following the principle of least privileges.

To change the scope of a GitHub organization secret:

1. Browse to the Settings tab of your GitHub organization’s repository where the secret is located.
2. Click on the Secrets menu located in the left-hand side of the page.
3. Select the required secret and click on its name to open the details page.
4. Click on the Edit button on the top right-hand corner of the page.
5. Under Repository access, select the repositories that should have access to the secret.
6. Click on the Update secret button to save the changes.

   For more information refer to https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization.