Permissive organization base permissions

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_29
Category	IAM
Severity	LOW

Impact

Organization base permissions apply to all organization members when accessing any organization repository. Any permission besides None, potentially allows compromised accounts to be used by attackers to steal all code stored in the organization repositories. In addition, Read permissions and higher can potentially allow executing attacks against CI/CD pipelines by triggering builds based on forks containing malicious code.

Recommended Solution - Buildtime

It is recommended to apply the principle of least privilege, by setting the organization base permissions to None, and grant granular permissions on repositories based on the organization needs. To configure base permissions for an organization, refer to GitHub documentation: https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/setting-base-permissions-for-an-organization.