Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
CI/CD Security - GitHub Actions Vulnerability
Mission
Investigate the GitHub Actions workflows under `/challenge/repo/.github/workflows/` and the run logs under `/challenge/logs/`. Exactly one workflow has a "pwn request" vulnerability that meets all three conditions: a `pull_request_target` trigger, an explicit checkout of the untrusted PR head, and use of `secrets`. The flag is in a comment on that vulnerable step. Workflows missing any condition are decoys.
Hints
Hint 1 Show
Review all workflows in /challenge/repo/.github/workflows/; many look risky but are actually safe
Hint 2 Show
Only one is truly exploitable: pull_request_target that checks out the untrusted PR head AND uses secrets
Hint 3 Show
The flag is in a YAML comment on that vulnerable step