CVE-2023-52137: Potential Actions command injection in output filenames
Summary
CVE-2023-52137: Potential Actions command injection in output filenames (GHSL-2023-275). Affects tj-actions/verify-changed-files versions < 17. Fixed in 17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tj-actions/verify-changed-files package is a GitHub Actions action that provides functionality to verify changed files within a workflow execution. It returns a list of files that have been modified. This package is vulnerable to a potential command injection in output filenames, which can allow an attacker to execute arbitrary code and potentially leak secrets.
Vulnerability Detail
The verify-changed-files workflow in tj-actions/verify-changed-files allows for command injection in changed filenames. This means that if a filename contains special characters such as ; or backticks, an attacker can take control of the GitHub Runner if the output value is used in a raw fashion inside a run block. By running custom commands, an attacker may be able to steal secrets such as the GITHUB_TOKEN. The vulnerability can be exploited by submitting a pull request with a new file that injects a command. Upon approval of the workflow triggered by the pull request, the malicious filename will flow into the List all changed files tracked and untracked files step, resulting in arbitrary command execution in the GitHub Runner.
How To Fix
Minimum fixed version
17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the tj-actions/verify-changed-files package is vulnerable to a potential command injection in output filenames. This vulnerability can lead to arbitrary command execution in the GitHub Runner and potential leakage of secrets. To fix this vulnerability, it is recommended to implement a new safe_output input and use environment variables to store unsafe outputs. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tj-actions/verify-changed-files →
FAQ
This vulnerability can lead to arbitrary command execution in the GitHub Runner, potentially allowing an attacker to steal secrets and compromise the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.7.
Yes, the recommended fix is to implement a new safe_output input in the tj-actions/verify-changed-files package that escapes special characters in filename paths. It is also advised to use environment variables to store unsafe outputs.
You can refer to the following resources for more information:
- Keeping your GitHub Actions and workflows secure Part 2: Untrusted input (https://securitylab.github.com/research/github-actions-untrusted-input/)
- Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests (https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
