Unrestricted usage of GitHub Actions allowed across the organization

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_130
Category	Supply Chain
Severity	HIGH

Impact

Allowing all GitHub Actions to be used in all repositories across the organization regardless of their author, exposes the organization to the risk of a malicious actor taking control over an action's repository. A hijacked action in use in your pipeline can potentially execute malicious code which can reach the production environment.

Recommended Solution - Buildtime

Enforce policies to control how organization repositories can use GitHub Actions:

1. Navigate to organization Settings > Actions > General tab.
2. If only using actions defined in repositories within the enterprise, select the Allow enterprise actions and reusable workflows policy setting.
3. If this policy is too restrictive, consider allowing specific actions, allowing actions created by GitHub and/or allowing actions by Marketplace verified creators.

Prisma Cloud recommends configuring permissions at the highest level possible, that is Enterprise, if your license supports it. If Enterprise is not available, configure permissions at the organization level, as all child entities will by default inherit the parent permissions.

For more information refer to: https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization.