PT-2023-22820 · Unknown · Embano1/Wip

R3X · Publicado 2023-04-24 · Atualizado 2023-05-04 · CVE-2023-30623

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions embano1/wip versions prior to 2

Description The embano1/wip action uses the github.event.pull request.title parameter in an insecure way, resulting in a command injection vulnerability due to string interpolation. This issue can be triggered by any user on GitHub by creating a pull request with a commit message containing an exploit. The commit can be genuine, but the commit message can be malicious, allowing for the execution of code on the GitHub runners and the exfiltration of secrets used in the CI pipeline, including repository tokens.

Recommendations To resolve the issue, update the embano1/wip action to version 2 by replacing the line in your workflow with uses: embano1/wip@v2 or using the exact commit uses: embano1/wip@c25450f77ed02c20d00b76ee3b33ff43838739a2. As a temporary workaround, consider restricting access to the github.event.pull request.title parameter to minimize the risk of exploitation. Avoid using the github.event.pull request.title parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-30623

GHSA-RG3Q-PRF8-QXMP

Produtos afetados

Embano1/Wip

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30623.json · Exploit
• 🔥 https://securitylab.github.com/research/github-actions-untrusted-input · Exploit
• https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp · Aviso do Fabricante
• https://github.com/embano1/wip/commit/c25450f77ed02c20d00b76ee3b33ff43838739a2 · Correção
• https://github.com/embano1/wip · Nota
• https://t.me/cvenotify/49016 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30623 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30623 · Aviso do Fabricante
• https://t.me/cibsecurity/62782 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-rg3q-prf8-qxmp · Aviso do Fabricante