PT-2023-22820 · Unknown · Embano1/Wip

R3X · Published 2023-04-24 · Updated 2023-05-04 · CVE-2023-30623

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions embano1/wip versions prior to 2

Description The embano1/wip action uses the github.event.pull request.title parameter in an insecure way, resulting in a command injection vulnerability due to string interpolation. This issue can be triggered by any user on GitHub by creating a pull request with a commit message containing an exploit. The commit can be genuine, but the commit message can be malicious, allowing for the execution of code on the GitHub runners and the exfiltration of secrets used in the CI pipeline, including repository tokens.

Recommendations To resolve the issue, update the embano1/wip action to version 2 by replacing the line in your workflow with uses: embano1/wip@v2 or using the exact commit uses: embano1/wip@c25450f77ed02c20d00b76ee3b33ff43838739a2. As a temporary workaround, consider restricting access to the github.event.pull request.title parameter to minimize the risk of exploitation. Avoid using the github.event.pull request.title parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-30623

GHSA-RG3Q-PRF8-QXMP

Affected Products

Embano1/Wip

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30623.json · Exploit
• 🔥 https://securitylab.github.com/research/github-actions-untrusted-input · Exploit
• https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp · Vendor Advisory
• https://github.com/embano1/wip/commit/c25450f77ed02c20d00b76ee3b33ff43838739a2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-30623 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30623 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rg3q-prf8-qxmp · Vendor Advisory
• https://github.com/embano1/wip · Note
• https://t.me/cvenotify/49016 · Telegram Post
• https://t.me/cibsecurity/62782 · Telegram Post