Backdooring the next release of Codex through Github Action Pipeline exploit chaining

Disclosed by
W0rty
  • Engagement OpenAI
  • Disclosed date 27 days ago
  • Reward $1,000
  • Priority P1 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by W0rty

Depi's Research Team discovered a full CI/CD compromise chain against openai/codex, starting from a prompt injection in the issue-labeler.yml workflow that lets any user embed attacker-controlled instructions in a GitHub issue and achieve command execution inside the Codex agent sandbox. From there, the team escaped the workspace-write sandbox by abusing .NET CLR debug pipes exposed in /tmp/ to read runner process memory and leak the ACTIONS_RUNTIME_TOKEN and GITHUB_TOKEN. Those credentials enabled GitHub Actions cache poisoning, pivoting execution into the more privileged rust-ci.yml workflow, gaining contents: write, and planting a persistent backdoored workflow with id-token: write. Because @openai/codex sees roughly 10M (spiking to 200M) weekly npm downloads, the chain represents a critical supply-chain risk capable of publishing malicious releases under a trusted OpenAI identity.

Activity