Default workflow permissions in the repository set to 'read and write'

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_127
Category	Pipeline Based Access Controls
Severity	MEDIUM

Impact

When a pipeline is executed, GitHub creates a short-lived token for interacting with the repository named GITHUB_TOKEN. If the pipeline's default permissions are set to 'read and write', the GITHUB_TOKEN is assigned with 'write' permissions. An attacker gaining access to a GitHub Actions pipeline with 'write' permissions can push malicious code into the repository, which could potentially reach the production environment.

Recommended Solution - Buildtime

Follow the ‘least privileges’ principle and reduce the potential attack surface by making sure that the pipeline is only granted the minimum required permissions. Best security practice is to set the default permissions for the GITHUB_TOKEN to read access only for all scopes. The permissions can then be elevated as required for individual jobs within the pipeline file.

Prisma Cloud recommends configuring permissions at the highest level possible, that is Enterprise, if your license supports it, otherwise at organization level, as all child entities will by default inherit the parent permissions

For more information refer to: https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#configuring-the-private-fork-policy-for-an-organization