Summary

Workflow runs with full write permissions, check-types.yml unsafely checks out attacker's submitted code, and then runs it.

Details

PoC

1. Create a private repository containing the contents of cal.com
2. Change

   cal.com/.github/workflows/check-types.yml

   Line 8 in 9aa60fa

   runs-on: buildjet-4vcpu-ubuntu-2204

   to ubuntu-latest (or you could wire up a custom runner if you want to give GitHub more money, that's a bad use of money)
3. Create a branch
4. Change

   cal.com/package.json

   Line 73 in 9aa60fa

   "type-check:ci": "turbo run type-check:ci --log-prefix=none",

   to run something exciting touch a; git add a; git config user.name user; git config user.email hello@example.com; git push origin HEAD:main
5. Push the branch to your private repository
6. Create a PR from your private repository to your private repository's main branch

Note that it isn't possible to safely test this in public but there is nothing in the code flow that's blocking a fork from doing this as the pull_request_target has removed the permissions block.

So, what's happening...

Selects the target and default permissions (this repository defaults to write, you could set it to read only, but that wouldn't do what you want).

passes permissions down.

performs a safe checkout because checkout defaults to being cautious

is as it says, dangerous.

now you've checked out the attacker's code.

This does a yarn install, which isn't terribly exciting.

now we run the attacker's command.

Impact

The repository's contents are compromised.

The GITHUB_TOKEN can merge PRs, mutate them, add / delete comments, push commits to the repository, delete branches from the repository, force-push over branches in the repository.

Unless you have lots of other machinery guarding against things, which seems unlikely (and the github token can often undo that machinery).

---

Note that it's likely there are other workflows that can also be attacked.

In general, you're going to want to split your workflows into multiple jobs, some with contents:read (the stuff that runs untrusted content), and others w/ and use an artifact or similar to transfer data between them so that you control what data is processed by the side with write permissions.