# How I accidentally took down GitHub Actions

GitHub Actions config wizard embedded 7-char commit shorthashes; a fork-pushed colliding commit made the tarball URL 404, breaking all builds globally.

- Payout: $5,000
- Severity: high
- Program: GitHub
- Credited: Teddy Katz
- Disclosed: 2019-11-12
- Write-up quality: 8/10
- Original: https://blog.teddykatz.com/2019/11/12/github-actions-dos.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-12-github-actions-dos-html
- Tags: domain:web3 impact:dos impact:mass-exploit kind:bounty platform:blog sev:high tech:ci-cd tech:github-actions technique:recon technique:source-review vuln:dos

**Target:** GitHub Actions workflow runner / config wizard commit reference resolution
**Root cause:** Config wizard generated abbreviated 7-char commit shorthashes instead of full 40-char hashes; the runner resolved these via the tarball API, which returns 404 when a shorthash is ambiguous across forks.
**Steps:**
1. Create workflow via wizard selecting issue_comment trigger and Docker action; observe `uses = "actions/docker/cli@76ff57a"` shorthash in generated config.
2. Clone actions/docker at 76ff57a6c3d817840574a98950b0c7bc4e8a13a8, make a new commit, and amend the commit message repeatedly until the hash starts with `76ff57a` (e.g. 76ff57aa21370794040cd0caafd84d8a7aa0927c).
3. Fork actions/docker and push the colliding commit to the fork (commits are shared between forks and parents).
4. Request `https://api.github.com/repos/actions/docker/tarball/76ff57a`; observe 404 due to ambiguity.
5. Any Actions build referencing that shorthash fails.
**How found:** Noticed the wizard emitted a 7-char shorthash rather than a full hash, reasoned about birthday-problem ambiguity in large repos, then realized collisions could be forced cheaply by amending commit messages locally rather than waiting for natural collisions.
**Exploitation:** Attacker with no write access forks a popular action repo, brute-forces a commit whose 7-char shorthash matches the referenced commit, and pushes it to the fork. The shared commit graph makes the shorthash ambiguous, so the tarball API returns 404 and every workflow pinned to that shorthash breaks globally.
**Escalation:** Could be scaled by precomputing a branch containing all 2^28 shorthashes (~24-47GB) and pushing it to forks of many popular repos, breaking all shorthash references at once.
**Insight:** Any system resolving abbreviated identifiers (git shorthashes, short URLs, truncated IDs) against a shared namespace is vulnerable to forced collisions; check whether forks/other tenants share the namespace and whether ambiguity fails open or closed.