# Code to Cloud Attacks: From Github PAT to Cloud Control Plane

Leaked GitHub PATs with standard dev permissions let attackers harvest Action secret names, run malicious workflows, and exfiltrate CSP credentials for cloud lateral movement.

- Payout: Real-world hack
- Severity: high
- Program: GitHub
- Credited: Wiz Research
- Disclosed: 2025-12-09
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/github-attacks-pat-control-plane
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-attacks-pat-control-plane
- Tags: domain:cloud impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:github-actions technique:chained technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** GitHub Actions / PAT / CSP control plane
**Root cause:** GitHub code-search API reveals secret names embedded in workflow YAML, and Actions secret masking only blocks the exact secret string, so double-base64 encoding or webhook exfiltration leaks raw CSP credentials.
**Steps:**
1. Enumerate secret names via code search: `curl -H "Authorization: Bearer $GH_TOKEN" "https://api.github.com/search/code?q=org:$GH_ORG_NAME+%24%7B%7B%20secrets."`
2. Create malicious workflow/PR to trigger Action execution with write-scoped PAT
3. Exfiltrate secret by double-encoding: `echo -n "${{ secrets.SECRET_NAME }}" | base64 -w 0 | base64` and read run log
4. Or send secret to attacker-controlled webhook to bypass logs entirely
5. Use CSP credential to create new Access Key for same principal, print to logs (unmasked), read via PAT
6. Delete workflow logs, runs, PRs, branches with write PAT to evade detection
**How found:** Incident response: Wiz CIRT observed attackers using standard-permission PATs against repo-to-cloud trust; noted code-search API calls are unlogged and that secret masking fails on transformed values.
**Exploitation:** Attacker with leaked PAT reads org code to harvest secret names, pushes a workflow that prints double-base64-encoded secrets or posts them to a webhook, retrieves CSP keys from run logs, then uses them to mint persistent cloud credentials and pivot into the cloud control plane.
**Escalation:** Chained GitHub repo access to CI/CD execution to CSP credential theft to cloud control plane lateral movement; new cloud keys printed to logs give persistence.
**Insight:** Secret masking compares the literal secret string, so any reversible transform (double base64, hex, chunking) defeats it; also enumerate `${{ secrets.` via code search to map secret names without admin scope.