CVE-2023-27581: Arbitrary Code Execution in github-slug-action
Summary
CVE-2023-27581: github-slug-action vulnerable to arbitrary code execution. Affects rlespinasse/github-slug-action versions >= 4.0.0, < 4.4.1. Fixed in 4.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github-slug-action is a GitHub Actions package that allows users to generate a unique slug for pull requests and branches. It is commonly used in CI/CD pipelines to automate workflows. This package is vulnerable to an arbitrary code execution vulnerability that can be triggered by any user on GitHub when using the action on pull requests. The vulnerability arises from the insecure usage of the github.head_ref parameter. Attackers can exploit this vulnerability by creating a pull request with a specially crafted branch name containing malicious code. This can lead to code execution on GitHub runners, potential resource wastage through crypto-mining, and the exfiltration of secrets used in the CI pipeline.
Vulnerability Detail
The vulnerability in github-slug-action allows any user on GitHub to execute arbitrary code on the GitHub runners by manipulating the github.head_ref parameter. This can have severe consequences, including unauthorized code execution, resource abuse, and the potential exposure of sensitive information. The vulnerability can be exploited by creating a pull request with a malicious branch name. The impact is not limited to a specific workflow or repository, making it a critical security concern for users of github-slug-action.
How To Fix
Minimum fixed version
4.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are impacted by this vulnerability, there is no available workaround. It is crucial to upgrade to the patched version of github-slug-action to address the issue.
Conclusion
The arbitrary code execution vulnerability in github-slug-action poses a significant security risk to users of this package. It is crucial to upgrade to the patched version to prevent unauthorized code execution, resource abuse, and potential exposure of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rlespinasse/github-slug-action →
FAQ
The vulnerability can be exploited by creating a pull request with a branch name containing malicious code. When the pull request is processed, the malicious code can be executed on the GitHub runners.
The consequences of this vulnerability include unauthorized code execution on GitHub runners, potential resource wastage through crypto-mining, and the possibility of sensitive information being exfiltrated from the CI pipeline.
Yes, any workflow using github-slug-action on pull requests is potentially affected by this vulnerability. It is important to upgrade to the patched version to mitigate the risk.
No, the vulnerability requires the attacker to create a pull request with a specially crafted branch name. Without a pull request, the vulnerability cannot be triggered.
First-time pull requests will not be executed, but an attacker can submit a valid pull request before submitting an invalid one to exploit the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for rlespinasse/github-slug-action.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
