PT-2020-14294 · Github · @Actions/Core
Moderatechrispat
·
Published
2020-10-01
·
Updated
2021-11-18
·
CVE-2020-15228
CVSS v2.0
4.0
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
@actions/core versions prior to 1.2.6
Description
The issue arises from the
addPath and exportVariable functions in the @actions/core npm module, which communicate with the Actions Runner over stdout by generating a string in a specific format. This can lead to unintended modification of paths or environment variables when workflows log untrusted data to stdout. The problem is caused by the way commands are exchanged between the Action runner process and the executed action through the standard output stream (STDOUT), where the Actions Runner parses the standard output and identifies command markers.Recommendations
For versions prior to 1.2.6, upgrade to
@actions/core v1.2.6 or later, and replace any instance of the set-env or add-path commands in workflows with the new Environment File Syntax. As a temporary workaround, consider restricting the use of the addPath and exportVariable functions until the update is applied.Exploit
Fix
Command Injection
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Actions/Core