PT-2023-18667 · Act · Act
Kevin Stubbings
+1
·
Publicado
2023-01-20
·
Atualizado
2024-08-20
·
CVE-2023-22726
CVSS v3.1
8.0
Alta
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
act versions prior to 0.2.40
Description
The artifact server in act does not sanitize path inputs, allowing an attacker to download and overwrite arbitrary files on the host from a Github Action, potentially leading to privilege escalation. The "/upload" endpoint is vulnerable to path traversal as the
filepath is user-controlled and flows into os.Mkdir and os.Open. The "/artifact" endpoint is also vulnerable to path traversal as the path variable is user-controlled and the specified file is returned by the server.Recommendations
For versions prior to 0.2.40, upgrade to version 0.2.40 or later.
As a temporary workaround, consider using
ValidPath() to check against path traversal or clean the user-provided paths manually during implementation of Open and OpenAtEnd for FS.
Avoid using the artifact server with the --artifact-server-path parameter until the issue is resolved.Exploit
Correção
Unrestricted File Upload
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Act