PT-2024-35384 · Unknown · Step-Security/Harden-Runner

Woodruffw · Published 2024-11-18 · Updated 2024-11-19 · CVE-2024-52587

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions step-security/harden-runner versions prior to v2.10.2

Description The issue concerns command injection weaknesses via environment variables in step-security/harden-runner. These weaknesses could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low. There are no known exploits at this time. The weaknesses are found in several areas, including the use of execSync with interpolated variables, such as process.env.USER and $USER, which an attacker could modify to inject arbitrary shell expressions. Additionally, the expansion of getRunnerTempDir() may be injectable due to its dependence on potentially attacker-controllable environment variables, such as RUNNER TEMP.

Recommendations For versions prior to v2.10.2, update to version 2.10.2, which contains a patch for the command injection weaknesses. As a temporary workaround, consider restricting the modification of environment variables, such as USER and RUNNER TEMP, to minimize the risk of exploitation. Additionally, consider replacing the use of execSync with execFileSync or similar to bypass shell evaluation and reduce the risk of command injection.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-52587

GHSA-G85V-WF27-67XC

Affected Products

Step-Security/Harden-Runner

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52587.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52587 · Security Note
• https://osv.dev/vulnerability/GHSA-g85v-wf27-67xc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52587 · Vendor Advisory
• https://github.com/step-security/harden-runner · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61 · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229 · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169 · Note
• https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53 · Note
• https://github.com/step-security/harden-runner/commit/0080882f6c36860b6ba35c610c98ce87d4e2f26f · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44 · Note
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57 · Note
• https://twitter.com/VulmonFeeds/status/1858680598878937259 · Twitter Post
• https://t.me/cvedetector/11390 · Telegram Post