PT-2022-24816 · Some Natalie · Ghas-To-Csv

Aegilops + 1 · Published 2022-09-16 · Updated 2022-09-21 · CVE-2022-39217

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions some-natalie/ghas-to-csv versions prior to v1

Description The issue arises from the GitHub Action creating a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code or formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program.

Recommendations For versions prior to v1, update to version v1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of custom fields that may contain executable code or formulas in the GitHub Advanced Security API until the update is applied.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-1236

Related Identifiers

CVE-2022-39217

GHSA-634P-93H9-92VH

Affected Products

Ghas-To-Csv

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39217.json · Exploit
• https://github.com/some-natalie/ghas-to-csv/commit/d0b521928fa734513b5cd9c7d9d8e09db50e884a · Patch
• https://github.com/some-natalie/ghas-to-csv/security/advisories/GHSA-634p-93h9-92vh · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39217 · Security Note
• https://osv.dev/vulnerability/GHSA-634p-93h9-92vh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39217 · Vendor Advisory
• https://github.com/some-natalie/ghas-to-csv/pull/20 · Note
• https://github.com/some-natalie/ghas-to-csv · Note
• https://github.com/some-natalie/ghas-to-csv/issues/19 · Note
• https://t.me/cibsecurity/50011 · Telegram Post