CVE-2024-54132: Path Traversal Vulnerability in github.com/cli/cli Due to Malicious GitHub Actions Workflow Artifact Download
Summary
CVE-2024-54132: Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gh · Debian:12
- github.com/cli/cli/v2 · Go
The same CVE-2024-54132 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'github.com/cli/cli' package is a command-line interface for GitHub, allowing users to interact with GitHub repositories and perform various actions directly from the terminal. It is widely used for automating workflows and managing GitHub resources efficiently. However, this package has been found to be vulnerable to a path traversal attack when downloading artifacts from malicious GitHub Actions workflows, potentially compromising the security of the user's system.
Vulnerability Detail
The vulnerability arises from the way the 'github.com/cli/cli' package handles the downloading of GitHub Actions workflow artifacts. If an attacker crafts a malicious workflow that includes specially designed file paths, the CLI may inadvertently write files to unintended locations on the user's file system. This can lead to unauthorized access to sensitive files, data corruption, or even remote code execution, depending on the nature of the files written and the permissions of the executing user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid downloading artifacts from untrusted or unknown GitHub Actions workflows. Always verify the source of the workflow before executing any commands that involve downloading artifacts.
Conclusion
The path traversal vulnerability identified as CVE-2024-54132 in the 'github.com/cli/cli' package poses significant risks to users who download artifacts from malicious GitHub Actions workflows. It is crucial to update to the patched version 2.63.1 or later to mitigate these risks and ensure the security of your system.
See every vulnerability recorded for github.com/cli/cli →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file access and potential system compromise.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If you cannot update the package right away, ensure that you do not download artifacts from untrusted sources as a precautionary measure.
Yes, the vulnerability affects all versions of 'github.com/cli/cli' prior to version 2.63.1 and 'github.com/cli/cli/v2' prior to the fixed version.
The consequences can include unauthorized access to sensitive files, data corruption, and potential remote code execution, depending on the attacker's actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli.
