PT-2023-31929 · Github · Tj-Actions/Verify-Changed-Files

Jorgectf

+1

·

Published

2023-12-29

·

Updated

2024-01-10

·

CVE-2023-52137

CVSS v3.1

7.7

High

VectorAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions tj-actions/verify-changed-files versions prior to 17
Description The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The verify-changed-files workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as ; which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside a run block. By running custom commands, an attacker may be able to steal secrets such as GITHUB TOKEN if triggered on other events than pull request.
Recommendations To resolve the issue, update to version 17 or later, which enables safe output by default and returns filename paths escaping special characters for bash environments. As a temporary workaround, consider using environment variables to store unsafe outputs, such as CHANGED FILES, to minimize the risk of exploitation. For example:
- name: List all changed files tracked and untracked files
 env:
   CHANGED FILES: ${{ steps.verify-changed-files.outputs.changed files }}
 run: |
  echo "Changed files: $CHANGED FILES"

Exploit

Fix

Command Injection

RCE

Weakness Enumeration

CWE-77CWE-20

Related Identifiers

CVE-2023-52137
GHSA-GHM2-RQ8Q-WRHC

Affected Products

Tj-Actions/Verify-Changed-Files