ghsa-2m9h-r57g-45pj
Vulnerability from github
Published
2024-12-04 15:32
Modified
2024-12-04 22:17
Severity ?
6.3 (Medium) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green
Summary
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
Details

Summary

A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.

Details

This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.

In 2.63.1, gh run download will not download artifacts named .. and . and instead exit with the following error message:

error downloading ..: would result in path traversal

Impact

Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.

Remediation and Mitigation

  1. Upgrade gh to 2.63.1
  2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as .., to prevent path traversal risks.
Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cli/cli/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.63.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cli/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-54132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-04T15:32:45Z",
    "nvd_published_at": "2024-12-04T16:15:26Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`. \n\n### Details\n\nThis vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`.  The artifact name and `--dir` flag are used to determine the artifact\u2019s download path.  When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.\n\nIn `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:\n\n```\nerror downloading ..: would result in path traversal\n```\n\n### Impact\n\nSuccessful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.63.1`\n2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.",
  "id": "GHSA-2m9h-r57g-45pj",
  "modified": "2024-12-04T22:17:31Z",
  "published": "2024-12-04T15:32:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54132"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cli/cli"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.