PT-2022-27790 · Liuos · Liuos

Fhildfshjkdsaiojsga · Published 2022-12-28 · Updated 2023-01-13 · CVE-2022-46179

Positive Technologies (AI Summary)

CVSS v3.1

9.2

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiuOS versions 0.1.0 and prior

Description LiuOS is a small Python project that imitates the functions of a regular operating system. The issue allows an attacker to set the GITHUB ACTIONS environment variable to anything other than null or true, which enables them to skip authentication checks. A test script is run instead of allowing login when the variable is set to true.

Recommendations For versions 0.1.0 and prior, a potential workaround is to check for the GITHUB ACTIONS environment variable and set it to null to force credential checks. Update to the latest commit (c658b4f3e57258acf5f6207a90c2f2169698ae22) which requires the GITHUB ACTIONS variable to be set to true, thus preventing attackers from skipping authentication checks.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-46179

GHSA-F9X3-MJ2R-CQMF

Affected Products

Liuos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46179.json · Exploit
• 🔥 https://github.com/LiuWoodsCode/LiuOS/security/advisories/GHSA-f9x3-mj2r-cqmf · Exploit
• https://github.com/LiuWoodsCode/LiuOS/commit/c658b4f3e57258acf5f6207a90c2f2169698ae22 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46179 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46179 · Vendor Advisory
• https://t.me/cibsecurity/55462 · Telegram Post