Summary
I've identified an issue in our GitHub Action workflows:
- Command Injection Vulnerability: Standard workflows (
ci.yml and card-to-archive.yml) directly interpolate untrusted file names from fork PRs into shell script runner commands, allowing arbitrary command execution.
Scenario & Narration
During reviewing recent pull request #4694 , In this PR he/she submitted changes containing files with unusual characters in their names, specifically:
.github/workflows/file;id>.txtfile;env>env.txt;#.js
This was an attempt to exploit a Shell Command Injection vulnerability in our workflows.
Here is how the exploit works step-by-step:
- In
ci.yml and card-to-archive.yml, we retrieve list of changed files via tj-actions/changed-files.
- Workflow then run inline bash scripts using GitHub's template substitution:
npx prettier --check ${{ steps.changed-files.outputs.all_changed_files }}
Summary
I've identified an issue in our GitHub Action workflows:
ci.ymlandcard-to-archive.yml) directly interpolate untrusted file names from fork PRs into shell script runner commands, allowing arbitrary command execution.Scenario & Narration
During reviewing recent pull request #4694 , In this PR he/she submitted changes containing files with unusual characters in their names, specifically:
.github/workflows/file;id>.txtfile;env>env.txt;#.jsThis was an attempt to exploit a Shell Command Injection vulnerability in our workflows.
Here is how the exploit works step-by-step:
ci.ymlandcard-to-archive.yml, we retrieve list of changed files viatj-actions/changed-files.npx prettier --check ${{ steps.changed-files.outputs.all_changed_files }}