PT-2024-29282 · Unknown · Monkeytype

Pwntester

·

Published

2024-02-17

·

Updated

2024-09-11

·

CVE-2024-41127

CVSS v3.1

8.3

High

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Monkeytype versions prior to 24.30.0
Description The issue concerns a Poisoned Pipeline Execution through Code Injection in the ci-failure-comment.yml GitHub Workflow of Monkeytype. This vulnerability allows attackers to gain pull-requests write access by exploiting the lack of validation in the steps.pr num reader.outputs.content WorkFlow variable, which is later interpolated into a JS script. This enables an attacker to change the code to be executed.
Recommendations For Monkeytype versions prior to 24.30.0, update to version 24.30.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the ci-failure-comment.yml workflow to minimize the risk of exploitation. Avoid using the steps.pr num reader.outputs.content variable in the affected workflow until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74CWE-94

Related Identifiers

CVE-2024-41127
GHSA-WCJF-5464-4WQ9

Affected Products

Monkeytype