# Github Secrets exposed due to RCE in Formatter Action from pull_request_target event

Formatter GitHub Action on pull_request_target checked out attacker PR code and ran mvn, enabling RCE that leaked GITHUB_TOKEN and bot secrets, allowing pushes to googleapis repos.

- Payout: $500
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2020-12-17
- Write-up quality: 8/10
- Original: https://lf.lc/vrp/175896812/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-175896812
- Tags: domain:oss impact:integrity impact:internal-access kind:bounty platform:blog sev:high tech:github-actions technique:chained technique:source-review vuln:rce vuln:secrets-leak

**Target:** GitHub Actions workflow (formatting.yaml) running mvn fmt-maven-plugin
**Root cause:** Workflow triggered on pull_request_target (trusted, secrets mounted) but checks out the attacker-controlled PR ref and runs mvn on attacker pom.xml, breaking the trust boundary.
**Steps:**
1. Find repo with formatter action, e.g. googleapis/java-core/.github/workflows/formatting.yaml
2. Fork repo from account without write access
3. Modify pom.xml to add malicious `pluginRepository` hosting a backdoored com.coveo:fmt-maven-plugin
4. Commit and push to fork branch, open PR against upstream
5. Formatter action runs `mvn com.coveo:fmt-maven-plugin:format` on PR code, executing backdoored plugin
6. Plugin reads mounted secrets (GITHUB_TOKEN, YOSHI_CODE_BOT_TOKEN) and pushes commits to master
**How found:** Noticed the formatter workflow used pull_request_target (secrets mounted) yet checked out the PR ref, then read the action to see it runs mvn on the attacker-controlled pom.xml — a code-exec path.
**Exploitation:** Attacker PR triggers pull_request_target workflow which checks out PR ref; malicious pom.xml points Maven at attacker repo serving a backdoored fmt-maven-plugin; plugin executes in runner with secrets mounted, exfiltrating GITHUB_TOKEN (write to repo) and YOSHI_CODE_BOT_TOKEN, then pushes malicious commits to master.
**Escalation:** GITHUB_TOKEN write access to every repo using the formatter action (dozens in googleapis org); YOSHI_CODE_BOT_TOKEN could compromise yoshi-code-bot with write access to most googleapis repos.
**Insight:** pull_request_target is only safe if the workflow never checks out or executes PR-controlled code; grep workflows for pull_request_target combined with checkout of github.event.pull_request.head.ref or head.sha, then look for build tools (mvn/gradle/npm) that honor attacker-controlled config like pom.xml pluginRepository.