CVE-2023-30623: Arbitrary command injection in embano1/wip
Summary
CVE-2023-30623: Arbitrary command injection in embano1/wip. Affects embano1/wip versions < 2. Fixed in 2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The embano1/wip package is a GitHub Actions workflow that is used for managing pull requests. It allows users to automate various tasks related to pull requests, such as running tests, linting code, and deploying changes. The package is widely used in GitHub repositories and provides a convenient way to streamline the pull request process.
Vulnerability Detail
The vulnerability in embano1/wip arises from the insecure usage of the github.event.pull_request.title parameter. This parameter is used in a run statement, which leads to a command injection vulnerability due to string interpolation. An attacker can exploit this vulnerability by creating a pull request with a commit message containing malicious code. This can result in the execution of arbitrary commands on the GitHub runners, potentially leading to unauthorized access, resource abuse (e.g., crypto-mining), and the exfiltration of sensitive information used in the CI pipeline, including repository tokens.
How To Fix
Minimum fixed version
2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update the workflows and mitigate the vulnerability.
Conclusion
The embano1/wip package is vulnerable to arbitrary command injection due to insecure usage of the github.event.pull_request.title parameter. This vulnerability can be exploited by creating a pull request with a malicious commit message, leading to unauthorized code execution and potential resource abuse. It is crucial to update the affected workflows to the recommended version or commit to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for embano1/wip →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the GitHub runners, potentially leading to unauthorized access, resource abuse, and the exfiltration of sensitive information used in the CI pipeline.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, an attacker can exploit this vulnerability remotely by creating a pull request with a malicious commit message.
There are no known instances of this vulnerability being exploited at the moment. However, it is important to update the affected workflows to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
