Summary
A GitHub workflow used inside the openvsx repo is vulnerable to command execution. An attacker can create a fork with a branch name containing shell characters which then gets executed when passed to the Sonar scanning action.
Details
The following GitHub action is vulnerable:
https://github.com/eclipse/openvsx/blob/master/.github/workflows/sonar.yml
Specifically:
- name: SonarCloud Scan on PR
if: github.event.workflow_run.event == 'pull_request'
uses: SonarSource/sonarqube-scan-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
args: >
-Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
-Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }}
-Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }}
-Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
The attackers branch can be called $(whoami) and this will execute whoami when it reaches the sonarqube-scan-action GH action:
- name: Run SonarScanner
run: |
args=(${{ inputs.args }})
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${args[@]}")
"${cmd[@]}"
PoC
We created a local testbed to prove this vulnerability:
Impact
The GITHUB_TOKEN and SONAR_TOKEN can be stolen
infosec-au Finder
Summary
A GitHub workflow used inside the openvsx repo is vulnerable to command execution. An attacker can create a fork with a branch name containing shell characters which then gets executed when passed to the Sonar scanning action.
Details
The following GitHub action is vulnerable:
https://github.com/eclipse/openvsx/blob/master/.github/workflows/sonar.yml
Specifically:
The attackers branch can be called
$(whoami)and this will executewhoamiwhen it reaches the sonarqube-scan-action GH action:PoC
We created a local testbed to prove this vulnerability:
Impact
The GITHUB_TOKEN and SONAR_TOKEN can be stolen