PT-2023-31929 · Github · Tj-Actions/Verify-Changed-Files
Jorgectf
+1
·
Publicado
2023-12-29
·
Atualizado
2026-05-29
·
CVE-2023-52137
CVSS v3.1
7.7
Alta
| Vetor | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
tj-actions/verify-changed-files versions prior to 17
Description
The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The verify-changed-files workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as
; which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside a run block. By running custom commands, an attacker may be able to steal secrets such as GITHUB TOKEN if triggered on other events than pull request.Recommendations
To resolve the issue, update to version 17 or later, which enables
safe output by default and returns filename paths escaping special characters for bash environments. As a temporary workaround, consider using environment variables to store unsafe outputs, such as CHANGED FILES, to minimize the risk of exploitation. For example:yaml
- name: List all changed files tracked and untracked files
env:
CHANGED FILES: ${{ steps.verify-changed-files.outputs.changed files }}
run: |
echo "Changed files: $CHANGED FILES"Exploit
Correção
RCE
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Tj-Actions/Verify-Changed-Files