PT-2022-24901 · Github · Kartverket/Github-Workflows

Eliihen · Published 2022-10-19 · Updated 2022-10-28 · CVE-2022-39326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kartverket/github-workflows versions prior to 2.7.5

Description The issue is a code injection vulnerability that affects all users of the run-terraform reusable workflow from the kartverket/github-workflows repo. A malicious actor could potentially send a PR with a malicious payload, leading to the execution of arbitrary JavaScript code in the context of the workflow.

Recommendations For versions prior to 2.7.5, upgrade to at least version 2.7.5 to resolve the issue. As a temporary workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-39326

GHSA-F9QJ-7GH3-MHJ4

Affected Products

Kartverket/Github-Workflows

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39326.json · Exploit
• https://github.com/kartverket/github-workflows/pull/19 · Patch
• https://github.com/kartverket/github-workflows/releases/tag/v2.7.5 · Patch
• https://osv.dev/vulnerability/GHSA-f9qj-7gh3-mhj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39326 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39326 · Vendor Advisory
• https://github.com/kartverket/github-workflows/security/advisories/GHSA-f9qj-7gh3-mhj4 · Note
• https://github.com/kartverket/github-workflows · Note
• https://t.me/cibsecurity/52041 · Telegram Post