Unrestricted usage of GitHub Actions allowed in the repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_129
Category	Supply Chain
Severity	HIGH

Impact

Allowing all GitHub Actions to be used in the repository regardless of their author, exposes the organization to the risk of a malicious actor taking control over an action's repository. When using a hijacked action, which is used in your pipeline, it can potentially execute malicious code reaching the production environment.

Recommended Solution - Buildtime

Enforce policies to control how the repository can use GitHub Actions:

1. Select repository Settings > Actions > General tab.
2. If only using Actions defined in repositories within the enterprise, select the Allow enterprise actions and reusable workflows policy setting.

📌 NOTE If the above policy is too restrictive, consider allowing specific actions, actions created by GitHub and/or actions by Marketplace verified creators.

Prisma Cloud recommends configuring permissions at the highest level possible, that is Enterprise, if your license supports it, otherwise at organization level, as all child entities will by default inherit the parent permissions.

For more information refer to: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-git