# ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts

GitHub Actions artifacts leak GITHUB_TOKEN/ACTIONS_RUNTIME_TOKEN; a race condition lets attackers download artifacts mid-run and push code to repos.

- Payout: Research
- Severity: high
- Program: Google VRP
- Credited: Yaron Avital
- Disclosed: 2024-08-13
- Write-up quality: 8/10
- Original: https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-github-repo-artifacts-leak-tokens
- Tags: domain:cloud domain:infra impact:integrity impact:rce kind:research platform:threat-intel sev:high tech:github-actions technique:race-window technique:recon vuln:race-condition vuln:secrets-leak

**Target:** GitHub Actions workflow artifacts and CI/CD pipelines
**Root cause:** actions/checkout persists GITHUB_TOKEN into .git by default, and users upload the whole checkout dir or super-linter logs as public artifacts. Artifacts v4 allows downloading while the workflow runs, so the token can be grabbed before job-end expiry.
**Steps:**
1. Enumerate public repos using upload-artifact@v4 with contents:write permission.
2. Trigger/watch a workflow_run event; launch a GitHub Actions workflow (RepoReaper) on GitHub infra for low latency.
3. Poll artifact download API dozens of times/sec within rate limits, disabling cert verification.
4. Selectively extract only .git/config from the compressed artifact to get the base64 GITHUB_TOKEN.
5. Use token via REST API to create a branch (write op) before the job finishes and token expires.
**How found:** Hunch that public workflow artifacts might contain secrets; automated downloading popular OSS artifacts and scanning for tokens. Found ghs_ and JWT tokens, traced to actions/checkout persist-credentials default and super-linter logging env vars. GitHub's v4 announcement of mid-run artifact download hinted a race condition was now possible.
**Exploitation:** Attacker waits for a pipeline run, downloads the in-progress public artifact, extracts the persisted GITHUB_TOKEN, and uses it to create a branch/push code to the target repo before job completion invalidates the token. For ACTIONS_RUNTIME_TOKEN (6h JWT), attacker replaces the artifact with a malicious one, achieving RCE on the runner consuming it.
**Escalation:** Chaining leaked token to push malicious code that flows through CI/CD to production, or access repo/org secrets; ACTIONS_RUNTIME_TOKEN enables artifact replacement leading to runner RCE.
**Insight:** Public CI artifacts are an overlooked secret surface: scan artifacts of repos using upload-artifact@v4, and note that v4's mid-run download turns job-scoped ephemeral tokens into a race-condition target—pick targets where steps follow the upload step to widen the window.