Deploy keys assigned with write permissions

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_26
Category	Pipeline Based Access Controls
Severity	LOW

Impact

Deploy keys created on GitHub repositories are assigned with write permissions. An attacker that obtains access to a deploy key with write permissions has excessive abilities on the repository, such as editing its code, creating, editing and deleting releases, and uploading packages.

Recommended Solution - Buildtime

To minimize the risk of a stolen deploy key to be used by an attacker, it is recommended to reduce the level of permissions of all deploy keys to read-only when write permissions are not necessary for the proper flow of the pipeline. To achieve this, for each deploy key:

1. Create a new deploy key in the same repository the current key was created on, and assign it with read-only permissions in the creation process. The same public key can be used to avoid creating a new private key.
2. Delete the older deploy key from the GitHub repository.

To create and delete deploy keys using the console, browse to the Deploy Keys tab under the repository settings.

To create and delete deploy keys using the API, follow the GitHub API documentation: https://docs.github.com/en/rest/reference/repos#deploy-keys.