PT-2024-40108 · Github Actions · Dawidd6/Action-Download-Artifact

Published 2024-11-25 · Updated 2024-11-25

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: dawidd6/action-download-artifact versions prior to v6

Description: The issue allows an unprivileged attacker to introduce compromised artifacts into a privileged workflow context by exploiting the default behavior of searching a repository's forks for matching artifacts. This can lead to artifact poisoning, where a malicious executable is retrieved and potentially executed in a privileged context. The vulnerability can be exploited by creating a fork of a public repository, modifying the build process to produce a compromised artifact, and then triggering the build to ensure the compromised artifact is always the latest. The severity of the impact ranges from downstream contamination to direct workflow compromise.

Recommendations: For dawidd6/action-download-artifact versions prior to v6, immediately upgrade to v6 or newer to change the default behavior and avoid searching forks for matching artifacts. For users who cannot upgrade, explicitly set allow forks: false to disable searching forks for artifacts.

Fix

Weakness Enumeration

CWE-349

Related Identifiers

GHSA-5XR6-XHWW-33M4

Affected Products

Dawidd6/Action-Download-Artifact

References · 5

• https://osv.dev/vulnerability/GHSA-5xr6-xhww-33m4 · Vendor Advisory
• https://github.com/dawidd6/action-download-artifact · Note
• https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 · Note
• https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4 · Note
• https://legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust · Note