PT-2024-29979 · Fish Shop · Syntax-Check

Marcransome · Published 2024-08-12 · Updated 2024-09-17 · CVE-2024-42482

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions fish-shop/syntax-check versions prior to v1.6.12 fish-shop/syntax-check versions prior to v2.0.0

Description The issue is related to improper neutralization of delimiters in the pattern input, specifically the command separator ; and command substitution characters ( and ). This allows for arbitrary command injection by modification of the input value used in a workflow, potentially exposing or exfiltrating sensitive information from the workflow runner.

Recommendations For versions prior to v1.6.12, update to version v1.6.12 or the latest release version v2.0.0. For versions prior to v2.0.0, update to version v2.0.0. As a temporary workaround, consider careful control of workflows and the pattern input value used by this action to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-140

Related Identifiers

CVE-2024-42482

GHSA-XJ87-MQVH-88W2

Affected Products

Syntax-Check

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42482.json · Exploit
• https://github.com/fish-shop/syntax-check/security/advisories/GHSA-xj87-mqvh-88w2 · Vendor Advisory
• https://github.com/fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03 · Patch
• https://github.com/fish-shop/syntax-check/commit/c2cb11395e21119ff8d6e7ea050430ee7d6f49ca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42482 · Security Note
• https://osv.dev/vulnerability/GHSA-xj87-mqvh-88w2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42482 · Vendor Advisory
• https://github.com/fish-shop/syntax-check · Note
• https://twitter.com/CVEnew/status/1823024481536786864 · Twitter Post
• https://t.me/cvenotify/94897 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823026747463352705 · Twitter Post
• https://t.me/cvedetector/2858 · Telegram Post