Description

Detects when the protection rule of a GitHub repository's default branch permits the branch to be deleted. Anyone with write access can then remove the branch the organization releases from, taking with it the reference that pipelines, deployments and integrations resolve against.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, since branch protection cannot be read without it

• Requests the branch protection settings of the default branch and reads the nested enabled flag of the deletion setting

• Reports a vulnerability when deletions are allowed; a branch with no protection rule at all is left to the protection check so that one setting does not produce two findings