CVE-2021-21423: Vulnerability in projen package allows unauthorized repository modifications
Summary
CVE-2021-21423: Rebuild-bot workflow may allow unauthorised repository modifications. Affects projen versions >= 0.6.0, < 0.16.41. Fixed in 0.16.41. How to fix ↓
Also tracked for
- projen · PyPI
The same CVE-2021-21423 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The projen package is a project generation tool that generates project configuration files based on a JavaScript definition. It creates files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more. The package is widely used for project setup and configuration. However, a vulnerability in the NodeProject project type of projen allows untrusted users to trigger the execution of untrusted code in the main repository, potentially leading to unauthorized modifications. This vulnerability affects projen versions 0.6.0 to 0.16.40.
Vulnerability Detail
The vulnerability arises from the rebuild-bot workflow included in projen's NodeProject project type. This workflow is triggered by comments containing '@projen rebuild' on pull requests. It executes with a GITHUB_TOKEN belonging to the repository into which the pull request is made, allowing untrusted code execution in the context of the main repository. If the default branch of the repository does not have branch protection configured, an attacker could potentially gain access to secrets configured on the repository. The vulnerability was patched in projen version 0.16.41, which removes the issue_comment trigger from the rebuild-bot workflow. Additionally, version 0.17.0 of projen completely removes the rebuild-bot.yml workflow.
How To Fix
Minimum fixed version
0.16.41
This is the first release that contains the fix.
npm install projen@0.16.41Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading projen is not feasible, a workaround is to remove the .github/workflows/rebuild-bot.yml file from the project and add it to the .gitignore file. This can be done by modifying the projenrc.js file. By doing this, the rebuild-bot workflow will not be triggered, reducing the risk of unauthorized repository modifications.
Conclusion
The vulnerability in the projen package allows untrusted users to execute untrusted code in the main repository, potentially leading to unauthorized modifications. It is recommended to upgrade projen to version 0.16.41 or higher to fix the vulnerability. If upgrading is not possible, removing the rebuild-bot workflow file and adding it to the .gitignore file can mitigate the issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for projen →
FAQ
projen is a project generation tool that creates project configuration files based on a JavaScript definition. It is commonly used for setting up and configuring projects.
The rebuild-bot workflow is a workflow included in projen's NodeProject project type. It is triggered by comments containing '@projen rebuild' on pull requests and allows the execution of untrusted code in the main repository.
The vulnerability can be fixed by upgrading projen to version 0.16.41 or higher. Alternatively, the .github/workflows/rebuild-bot.yml file can be removed from the project and added to the .gitignore file.
The vulnerability allows untrusted users to execute untrusted code in the main repository, potentially leading to unauthorized modifications. If the default branch of the repository does not have branch protection configured, an attacker could gain access to secrets configured on the repository.
Yes, if upgrading projen is not possible, a workaround is to remove the .github/workflows/rebuild-bot.yml file from the project and add it to the .gitignore file.
