Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Google Discloses Details of GitHub Actions Vulnerability

Details on a vulnerability impacting GitHub Actions were made public this week by Google, following a 104-day disclosure deadline.

Details on a vulnerability impacting GitHub Actions were made public this week by Google, following a 104-day disclosure deadline.

The bug was identified by security researcher Felix Wilhelm of Google Project Zero, who reported it to GitHub on July 21. As per Google’s policy, information on the flaw was meant to be released after 90 days, but GitHub requested a 14-day grace period.

Tracked as CVE-2020-15228, the vulnerability is related to the use of the set-env and add-path workflow commands, which are set to be disabled. GitHub has assigned the issue a moderate severity rating, but Google Project Zero says it’s high severity.

The set-env command supported by the Github action runner enables the user to define arbitrary environment variables, and the security researcher discovered that the feature is highly susceptible to injection attacks.

“As the runner process parses every line printed to STDOUT looking for workflow commands, every Github action that prints untrusted content as part of its execution is vulnerable. In most cases, the ability to set arbitrary environment variables results in remote code execution as soon as another workflow is executed,” Wilhelm notes.

The issue, GitHub confirms, is that paths and environment variables can be injected into workflows that log untrusted data to stdout, all without the intention of the workflow author.

In an October 1 post, the Microsoft-owned platform revealed that the @actions/core npm module should be updated to version 1.2.6, which updates the addPath and exportVariable functions.

GitHub introduced a new set of files meant for the management of environment and path updates in workflows, to ensure that users can continue to dynamically set environment variables.

Advertisement. Scroll to continue reading.

“The runner will release an update that disables the set-env and add-path workflow commands in the near future. For now, users should upgrade to @actions/core v1.2.6 or later, and replace any instance of the set-env or add-path commands in their workflows with the new Environment File Syntax,” GitHub explains.

Runner version 2.273.5 is already warning on the use of the add-path or set-env commands, and the plan is to fully disable them, GitHub said. Users are advised to upgrade as soon as possible, as no workarounds have been identified.

Related: Serious Vulnerability in GitHub Enterprise Earns Researcher $20,000

Related: GitHub Announces General Availability of Code Scanning Feature

Related: DeepSource Says Hackers Compromised Its GitHub Application

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.