PT-2023-18667 · Act · Act
Kevin Stubbings
+1
·
Published
2023-01-20
·
Updated
2024-08-20
·
CVE-2023-22726
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
act versions prior to 0.2.40
Description
The artifact server in act does not sanitize path inputs, allowing an attacker to download and overwrite arbitrary files on the host from a Github Action, potentially leading to privilege escalation. The "/upload" endpoint is vulnerable to path traversal as the
filepath is user-controlled and flows into os.Mkdir and os.Open. The "/artifact" endpoint is also vulnerable to path traversal as the path variable is user-controlled and the specified file is returned by the server.Recommendations
For versions prior to 0.2.40, upgrade to version 0.2.40 or later.
As a temporary workaround, consider using
ValidPath() to check against path traversal or clean the user-provided paths manually during implementation of Open and OpenAtEnd for FS.
Avoid using the artifact server with the --artifact-server-path parameter until the issue is resolved.Exploit
Fix
Unrestricted File Upload
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Act