Critical GitHub Actions Secrets Exfiltration Vulnerability in Cromwell
Summary
GHSA-phf6-hm3h-x8qp: Cromwell GitHub Actions Secrets exfiltration via Issue_comment. Affects broadinstitute/cromwell versions >= 87, < 90. Fixed in 90. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cromwell is an open-source workflow management system designed to execute scientific workflows in a reproducible manner. It is widely used in bioinformatics and other fields that require complex data processing. The package integrates with GitHub Actions to automate workflows, but it has a critical vulnerability that allows attackers to exfiltrate sensitive secrets, including high-privileged tokens.
Vulnerability Detail
The vulnerability arises from the use of the Issue_comment event in GitHub Actions, specifically in the workflow file .github/workflows/scalafmt-fix.yml. An attacker can inject malicious code into the comment body, which is then executed in a shell script without proper sanitization. This allows the attacker to exfiltrate sensitive tokens such as GITHUB_TOKEN and BROADBOT_GITHUB_TOKEN, potentially leading to complete control over the repository. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).
How To Fix
Minimum fixed version
90
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the permissions of the GITHUB_TOKEN to only what is necessary for your actions. For example:
permissions: issues: write
Conclusion
The Cromwell GitHub Actions vulnerability allows for the exfiltration of sensitive tokens through improper handling of user input in issue comments. It is critical to update to the latest version of the package and implement safe coding practices to mitigate this risk.
See every vulnerability recorded for broadinstitute/cromwell →
FAQ
The vulnerability has a CVSS score of 9.1, indicating it is critical and poses a significant risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
An attacker exploiting this vulnerability can gain full control over the repository, including the ability to modify code, delete files, and access sensitive information.
Yes, you can limit the permissions of the GITHUB_TOKEN and avoid using untrusted user input directly in shell scripts as a temporary measure.
Immediately rotate your GITHUB_TOKEN and BROADBOT_GITHUB_TOKEN, review your repository's commit history for unauthorized changes, and update to the patched version of Cromwell.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
