# Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk`

Dangling GitHub org name MirrorNG referenced as a base action in Shopify's unity-buy-sdk workflow could be re-registered to run malicious code with Shopify secrets.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: codermak
- Disclosed: 2022-07-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1439355
- Library page: https://bugbountylibrary.com/r/h1%3A1439355
- Tags: area:oss domain:oss impact:internal-access kind:bounty platform:hackerone sev:low tech:github-actions technique:recon technique:source-review vuln:access-control

**Target:** GitHub Actions workflow (.github/workflows/build.yml) in Shopify/unity-buy-sdk
**Root cause:** A base action referenced an external GitHub org (MirrorNG) that was renamed to MirageNet; the old username became free to register, breaking the redirect and letting anyone claim it.
**Steps:**
1. Open https://github.com/Shopify/unity-buy-sdk/blob/master/.github/workflows/build.yml#L71
2. Observe base action `MirrorNG/unity-runner`
3. Visit https://github.com/MirrorNG/unity-runner, redirected to https://github.com/MirageNet/unity-runner
4. Note https://github.com/MirrorNG shows the username is available for registration
5. Register the MirrorNG org and host a malicious action at `MirrorNG/unity-runner`
6. Open a PR to trigger the workflow, which passes Unity credentials to the attacker-controlled action
**How found:** Reading the workflow file, noticing the base action pointed at an external org, and observing GitHub's rename redirect plus the available-username takeover message.
**Exploitation:** Attacker registers the freed MirrorNG org, publishes a malicious unity-runner action, and waits for any PR to trigger the build workflow; the action receives Shopify Unity credentials and can mint a GITHUB_TOKEN for org repo access.
**Escalation:** GITHUB_TOKEN minted at runtime could grant access to all private repositories of the organization.
**Insight:** Audit CI workflows for third-party actions whose owner/repo redirects to a different name; a redirect means the original namespace is reclaimable and the pinned reference is hijackable.