Details on a vulnerability impacting GitHub Actions were made public this week by Google, following a 104-day disclosure deadline.
The bug was identified by security researcher Felix Wilhelm of Google Project Zero, who reported it to GitHub on July 21. As per Google’s policy, information on the flaw was meant to be released after 90 days, but GitHub requested a 14-day grace period.
Tracked as CVE-2020-15228, the vulnerability is related to the use of the set-env and add-path workflow commands, which are set to be disabled. GitHub has assigned the issue a moderate severity rating, but Google Project Zero says it’s high severity.
The set-env command supported by the Github action runner enables the user to define arbitrary environment variables, and the security researcher discovered that the feature is highly susceptible to injection attacks.
“As the runner process parses every line printed to STDOUT looking for workflow commands, every Github action that prints untrusted content as part of its execution is vulnerable. In most cases, the ability to set arbitrary environment variables results in remote code execution as soon as another workflow is executed,” Wilhelm notes.
The issue, GitHub confirms, is that paths and environment variables can be injected into workflows that log untrusted data to stdout, all without the intention of the workflow author.
In an October 1 post, the Microsoft-owned platform revealed that the @actions/core npm module should be updated to version 1.2.6, which updates the addPath and exportVariable functions.
GitHub introduced google discloses details github actions vulnerability
