replicatedhq/embedded-cluster #3917

replicatedhq/embedded-cluster #3917 · head 446bd94f · review complete · 6 findings · read only

Attack paths

How findings could affect users, with evidence and uncertainty kept together.

3 paths

Plausible paths based on review findings. Doomer checked the findings against the PR diff. Each path includes evidence and what remains uncertain.

01External action uses a mutable reference

Entry: CI job in the DR fixture candidate workflow resolves an action pinned to a mutable tag
Path: A tag repoint upstream makes the next run fetch and execute different code inside the DR fixture CI job
Possible impact: The replaced action runs with that workflow's credentials and could alter or leak the DR fixture artifacts
Review evidence: External action uses a mutable reference · .github/workflows/e2e-dr-fixture-candidate.yaml:51
Still uncertain: The review identified the mutable reference but did not verify the action's provenance or whether compromise has occurred

View finding and code

.github/workflows/e2e-dr-fixture-candidate.yaml:51 View GitHub comment

This action is pinned to a mutable tag — it can silently run different code on the next push upstream. Pin it to a full 40-character commit SHA (with a version comment if you like). High severity: a compromised action here gets your workflow's credentials.

02External action uses a mutable reference

Entry: An external action in the application releases workflow is referenced by a mutable tag
Path: A repointed tag causes subsequent pushes to silently run substituted code in the bundle assembly pipeline
Possible impact: Injected code executes with access to the workflow's credentials and release assembly steps
Review evidence: External action uses a mutable reference · .github/workflows/e2e-application-releases.yaml:39
Still uncertain: Only the mutable pin was established; actual compromise or credential exposure was not tested

View finding and code

.github/workflows/e2e-application-releases.yaml:39 View GitHub comment

Pinning this external action to a mutable ref means a tag repoint can run arbitrary code in CI. Pin to the full 40-char commit SHA (version comment optional).

03Immutable DR fixture publish fails on rerun: manifest bytes are nondeterministic but its S3 key is payload-derived

Entry: A rerun of the DR fixture publish writes a manifest whose S3 key is derived from payload bytes
Path: Nondeterministic manifest bytes change on rerun, so the derived key differs or collides with the existing immutable object and the publish fails
Possible impact: Repeated DR fixture publishes are blocked by an immutability check keyed on byte equality rather than semantics
Review evidence: Immutable DR fixture publish fails on rerun: manifest bytes are nondeterministic but its S3 key is payload-derived · e2e/dr_fixture.go:55
Still uncertain: The review found a rerun failure condition but did not confirm it in an executed test run

View finding and code

e2e/dr_fixture.go:55 View GitHub comment

Manifest bytes are nondeterministic, but its S3 key is payload-derived — rerunning the DR fixture publish collides with an immutable object. Base the immutability check on semantics rather than byte equality.