Outside Collaborator As Admin
More Info:
Allowing outside collaborators admin or push access to organization repositories places the organization at risk from non-member contributions that can be pushed without review.
Risk Level
Medium
Address
Security
Compliance Standards
Remediation
Using Console
The misconfiguration of having an outside collaborator as admin in GitHub can be remediated by following these steps:
-
Log in to your GitHub account and navigate to the repository where the outside collaborator has been added as an admin.
-
Click on the “Settings” tab located on the right-hand side of the repository.
-
In the left-hand menu, select “Collaborators & teams.”
-
Find the outside collaborator’s name in the list of collaborators and click on the gear icon next to their name.
-
From the dropdown menu, select “Remove from team.”
-
A confirmation message will appear asking if you’re sure you want to remove the user from the team. Click “Remove.”
-
Next, in the left-hand menu, select “Teams.”
-
Find the team that the outside collaborator was a part of and click on the gear icon next to the team’s name.
-
From the dropdown menu, select “Manage access.”
-
Find the outside collaborator’s name in the list of members and click on the gear icon next to their name.
-
From the dropdown menu, select “Remove from team.”
-
A confirmation message will appear asking if you’re sure you want to remove the user from the team. Click “Remove.”
-
Finally, it’s a good idea to review your repository’s security settings to make sure that only trusted collaborators have access to sensitive information.
By following these steps, you can remediate the misconfiguration of having an outside collaborator as an admin in GitHub.
Using CLI
The misconfiguration of having an outside collaborator as admin can be remediated in GitHub using the following steps via GitHub CLI:
-
Firstly, identify the username of the outside collaborator who has been given admin access.
-
Open the command prompt or terminal and log in to your GitHub account using the
gh auth login
command. -
Once you are logged in, use the
gh repo collaborator remove
command to remove the outside collaborator from the repository. For example, if the username of the outside collaborator is “exampleuser”, you can use the following command to remove them:gh repo collaborator remove exampleuser --admin
This will remove the user “exampleuser” from the repository and revoke their admin access.
-
After the collaborator has been removed, you can use the
gh repo collaborator add
command to add them back to the repository with the appropriate access level. For example, if you want to add the user “exampleuser” back to the repository with read access, you can use the following command:gh repo collaborator add exampleuser --permission read
This will add the user “exampleuser” back to the repository with read access.
-
Finally, it is recommended to review and update the access levels of all collaborators on the repository to ensure that they have appropriate access levels. This can be done using the GitHub web interface or the
gh repo collaborator
command.
Using Python
The misconfiguration of having an outside collaborator as admin on GitHub can be remediated using the following steps in Python:
- Authenticate with GitHub API using a personal access token with admin privileges.
import requests
# Replace <token> with your personal access token
headers = {
'Authorization': 'token <token>',
'Accept': 'application/vnd.github.v3+json'
}
- Get the list of collaborators for the repository.
# Replace <owner> and <repo> with the repository details
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators'
response = requests.get(url, headers=headers)
# Get the list of collaborators
collaborators = [collaborator['login'] for collaborator in response.json()]
- Check if the outside collaborator is listed as an admin.
# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
response = requests.get(url, headers=headers)
if response.json()['permission'] == 'admin':
# Remove the outside collaborator as admin
else:
# No action required
- Remove the outside collaborator as admin.
# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
data = {
'permission': 'push' # Set the permission to push
}
response = requests.put(url, headers=headers, json=data)
- Verify that the outside collaborator has been removed as admin.
# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
response = requests.get(url, headers=headers)
if response.json()['permission'] != 'admin':
print(f'{outside_collaborator} has been removed as admin.')
else:
print(f'Failed to remove {outside_collaborator} as admin.')