# Stealing a few more GitHub Actions secrets

Deleted branch name matching a commit shorthash let attacker reopen a PR whose base resolved to a malicious fork commit, executing pull_request_target Actions with repo secrets.

- Payout: $7,500
- Severity: high
- Program: GitHub
- Credited: Teddy Katz
- Disclosed: 2022-02-23
- Write-up quality: 8/10
- Original: https://blog.teddykatz.com/2022/02/23/ghosts-of-branches-past.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2022-02-23-ghosts-of-branches-past-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:github-actions technique:legacy-endpoint technique:source-review vuln:access-control vuln:auth-bypass

**Target:** GitHub pull request base-branch resolution and Actions pull_request_target workflows
**Root cause:** GitHub resolved a deleted base branch name to a commit shorthash in the repo, letting a closed PR be reopened with a base pointing at an attacker-controlled commit; Actions backend lacked branch-existence checks.
**Steps:**
1. Push a branch named `deadbeef` to a repo.
2. Open a PR from another branch targeting `deadbeef`, then close it.
3. Delete the `deadbeef` branch (PR auto-closes).
4. Use lucky-commit to craft a malicious commit with shorthash `deadbeef` containing a pull_request_target workflow, push to fork.
5. Reopen the PR; GitHub resolves base `deadbeef` to the attacker commit and runs the workflow with repo secrets and GITHUB_TOKEN.
**How found:** Explored git/GitHub ambiguity between branch names and commit shorthashes; noticed GitHub blocks 40-hex branch names but allows shorthashes, then tested deleted-branch PR reopen behavior and found the PR could be reopened because the name resolved to a commit.
**Exploitation:** Attacker waits for a maintainer to create a branch whose name parses as a commit shorthash, opens and closes a PR to it, waits for branch deletion, then pushes a malicious commit with matching shorthash and reopens the PR to trigger pull_request_target with secrets and write-scoped GITHUB_TOKEN.
**Escalation:** GITHUB_TOKEN grants write access to the repository in addition to secret exfiltration.
**Insight:** When a system resolves identifiers that can be either a mutable ref or an immutable hash, test the deleted-ref case: a name that shadowed a commit while the branch existed will silently resolve to the commit after deletion, reviving stale references.