Self-hosted runner group allows public repositories

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_181
Category	System Configuration
Severity	HIGH

Impact

Using a self-hosted runner with a public GitHub repository carries significant security risks, due to the fact that self-hosted runners are naturally less secure, as you have to design and maintain a secure solution for the runner. An attacker who forks public repositories can potentially run malicious code on self-hosted runners by creating a pull request that triggers a workflow, achieving persistence on the runner and access to local files and leftover secrets, as well as accessing internal infrastructure.

Recommended Solution - Buildtime

Evaluate the need to allow self-hosted runners to run on public repositories. If not required, use a hosted runner.

In addition, make sure to disable the Allow public repositories setting: Browse to Organization Settings > Actions > Runner Groups.

If you must use a self-hosted runner, implement mechanisms such as sandboxing, ephemeral build environments, and job isolation to mitigate risks.

For more information, please refer to https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group.