T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/run-full-workflow.sh:103- Finding
Dry-run mode still creates real GitHub issues
- Content
View full analysis
&1 | sed 's/Created:/[DRY RUN] Would create:/' || true else python3 "$SCRIPT_DIR/create-github-issues.py" "$OUTPUT_FILE" "$REPO_URL" || { echo -e "${YELLOW}Issue creation completed with warnings${NC}" } fi ``` The invoked Python script performs the real operation: ```python if create_issue(owner, repo, title, body): print(f" Created: {title}") created_count += 1 else: print(f" Failed to create: {title}") ``` ### Technical Analysis The dry-run branch invokes `create-github-issues.py` without passing any option that suppresses GitHub writes. The `sed` command only rewrites the subprocess's displayed output from `Created:` to `[DRY RUN] Would create:`. It does not intercept or disable the authenticated `gh issue create` requests executed by the Python process. Consequently, the workflow presents an operation as a simulation while using the authenticated GitHub CLI to make persistent changes. This violates the documented guarantee that dry-run mode performs no changes. ### Attack Path 1. The user authenticates GitHub CLI with write access to a target repository. 2. The workflow is invoked with `dry-run=true` and `skip-issues=false`. 3. The Snyk scan finds one or more vulnerabilities. 4. The dry-run branch executes `create-github-issues.py`. 5. The Python script invokes `gh issue create` for each applicable package. 6. Real GitHub issues are created, while the output is rewritten to claim they only would have been created. ### ...[truncated 438 chars]- Remediation
View remediation