DOS5850: Repository Collaborator - Outside collaborators should not have admin permission | Security KB - DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.

This website stores cookies on your computer.These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, please review our Privacy Policy.

If you decline, your information won’t be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.
By clicking “Accept All”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

GitHub repository Severitycritical builtIn

Description

When the per-repo collaborator audit (G2.4) lists a collaborator with Affiliation = 'outside' AND Permissions.Admin = true, this is a critical finding: an external user has admin rights on a specific repository. This is the per-repo equivalent of the org-level outside-collaborator audit and surfaces overrides where an outside collaborator was granted admin on a single repo despite org-level policy.

Learn More

https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization

Recommendation

1. Go to Repository Settings -> Collaborators and teams. 
2. Identify outside collaborators with admin role. 
3. Downgrade their permission to Maintain, Write, Triage, or Read as appropriate.

Policy Rule

{
  "target": "GHRepositoryCollaborator",
  "if": {
    "allOf": [
      {
        "resource": "GHRepositoryCollaborator",
        "property": "Affiliation",
        "operator": "equals",
        "value": "outside"
      },
      {
        "resource": "GHRepositoryCollaborator",
        "property": "Permissions.Admin",
        "operator": "notEquals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}

« DOS5815 DOS5855 »

Rule Details

Rule ID: DOS5850
Code: GH_Repository_Collaborator_Outside_Should_Not_Have_Admin
Platform: GitHub
Category: repository
Severity: Severitycritical
Type: builtIn

DOS5850

Repository Collaborator - Outside collaborators should not have admin permission

DOS5850

Description

Recommendation

Policy Rule

View evaluation logic (JSON)

Rule Details

Related Rules