Default workflow permissions in the organization set to 'read and write'

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_128
Category	Pipeline Based Access Controls
Severity	MEDIUM

Impact

When a pipeline is executed, GitHub creates a short-lived token for interacting with the repository named GITHUB_TOKEN. If the pipeline's default permissions are set to 'read and write', the GITHUB_TOKEN is assigned with 'write' permissions. An attacker gaining access to a GitHub Actions pipeline with 'write' permissions can push malicious code into the repository, which could potentially reach the production environment.

Recommended Solution - Buildtime

Follow the least privileges principal and reduce the potential attack surface by making sure that the pipeline is granted the minimum required permissions. It’s a good security practice to set the default permission for the GITHUB_TOKEN to read access only for repository contents. The permissions can then be increased, as required, for individual jobs within the pipeline file.

Prisma Cloud recommends configuring permissions at the highest level possible - Enterprise if your license supports it, otherwise at organization level, as all child entities will by default inherit the parent permissions.

For more information refer to: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#managing-github-actions-permissions-for-your-repository.