Skip to content

Commit 9411fac

Browse files
author
Alvaro Muñoz
committed
New Descriptions
1 parent d8df3ff commit 9411fac

25 files changed

+1860
-8
lines changed

‎ql/src/Security/CWE-077/EnvPathInjectionCritical.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Environment Path Injection
2+
3+
## Description
4+
5+
GitHub Actions allows to define the system PATH variable by writing to a file pointed to by the `GITHUB_PATH` environment variable. Writing to this file will prepend a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job. E.g.
6+
7+
```bash
8+
echo "$HOME/.local/bin" >> $GITHUB_PATH
9+
```
10+
11+
If an attacker can control the contents of the path being assigned to the system PATH, they will be able to influence what commands are run in subsequen steps of the same job.
12+
13+
## Recommendations
14+
15+
- Do Not Allow Untrusted Data to Influence The System PATH: Avoid using untrusted data sources (e.g., artifact content) to define the system PATH.
16+
17+
## Examples
18+
19+
### Incorrect Usage
20+
21+
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
22+
23+
```yaml
24+
steps:
25+
- name: Set the path
26+
env:
27+
BODY: ${{ github.event.comment.body }}
28+
run: |
29+
PATH=$(echo "$BODY" | grep -oP 'system path: \K\S+')
30+
echo "$PATH" >> "$GITHUB_PATH"
31+
```
32+
33+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially change the system PATH and get arbitrary command execution in subsequent steps.
34+
35+
## References
36+
37+
- [Workflow commands for GitHub Actions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions)

‎ql/src/Security/CWE-077/EnvPathInjectionMedium.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Environment Path Injection
2+
3+
## Description
4+
5+
GitHub Actions allows to define the system PATH variable by writing to a file pointed to by the `GITHUB_PATH` environment variable. Writing to this file will prepend a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job. E.g.
6+
7+
```bash
8+
echo "$HOME/.local/bin" >> $GITHUB_PATH
9+
```
10+
11+
If an attacker can control the contents of the path being assigned to the system PATH, they will be able to influence what commands are run in subsequen steps of the same job.
12+
13+
## Recommendations
14+
15+
- Do Not Allow Untrusted Data to Influence The System PATH: Avoid using untrusted data sources (e.g., artifact content) to define the system PATH.
16+
17+
## Examples
18+
19+
### Incorrect Usage
20+
21+
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
22+
23+
```yaml
24+
steps:
25+
- name: Set the path
26+
env:
27+
BODY: ${{ github.event.comment.body }}
28+
run: |
29+
PATH=$(echo "$BODY" | grep -oP 'system path: \K\S+')
30+
echo "$PATH" >> "$GITHUB_PATH"
31+
```
32+
33+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially change the system PATH and get arbitrary command execution in subsequent steps.
34+
35+
## References
36+
37+
- [Workflow commands for GitHub Actions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions)

‎ql/src/Security/CWE-077/EnvVarInjectionCritical.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# Environment Variable Injection
2+
3+
## Description
4+
5+
GitHub Actions allows to define Environment Variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
6+
7+
This file should lines in the `KEY=VALUE` format:
8+
9+
```bash
10+
steps:
11+
- name: Set the value
12+
id: step_one
13+
run: |
14+
echo "action_state=yellow" >> "$GITHUB_ENV"
15+
```
16+
17+
It is also possible to define a multiline variables by using the following format:
18+
19+
```
20+
KEY<<{delimiter}
21+
VALUE
22+
VALUE
23+
{delimiter}
24+
```
25+
26+
```bash
27+
steps:
28+
- name: Set the value in bash
29+
id: step_one
30+
run: |
31+
{
32+
echo 'JSON_RESPONSE<<EOF'
33+
curl https://example.com
34+
echo EOF
35+
} >> "$GITHUB_ENV"
36+
```
37+
38+
If an attacker can control the contents of the values assigned to these variables and these are not properly sanitized, they will be able to inject additional variables by injecting new lines or `{delimiters}`.
39+
40+
## Recommendations
41+
42+
1. **Do Not Allow Untrusted Data to Influence Environment Variables**:
43+
44+
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45+
- Validate and sanitize all inputs before using them in environment settings.
46+
47+
2. **Do Not Allow New Lines When Defining Single Line Environment Variables**:
48+
49+
- `echo "BODY=$(echo "$BODY" | tr -d '\n')" >> "$GITHUB_ENV"`
50+
51+
3. **Use Unique Identifiers When Defining Multi Line Environment Variables**:
52+
53+
```bash
54+
steps:
55+
- name: Set the value in bash
56+
id: step_one
57+
run: |
58+
# Generate a UUID
59+
UUID=$(uuidgen)
60+
{
61+
echo "JSON_RESPONSE<<EOF$UUID"
62+
curl https://example.com
63+
echo "EOF$UUID"
64+
} >> "$GITHUB_ENV"
65+
```
66+
67+
## Examples
68+
69+
### Example of Vulnerability
70+
71+
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
72+
73+
```yaml
74+
steps:
75+
- name: Set the value
76+
id: step_one
77+
env:
78+
BODY: ${{ github.event.comment.body }}
79+
run: |
80+
REPLACED=$(echo "$BODY" | sed 's/FOO/BAR/g')
81+
echo "BODY=$REPLACED" >> "$GITHUB_ENV"
82+
```
83+
84+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially inject new Environment variables. For example, they could write an Issue comment like:
85+
86+
```
87+
FOO
88+
NEW_ENV_VAR=MALICIOUS_VALUE
89+
```
90+
91+
Likewise, if the attacker controls a file in the Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact), and the contents of that file are assigned to an environment variable such as:
92+
93+
```bash
94+
- run: |
95+
PR_NUMBER=$(cat pr-number.txt)
96+
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
97+
```
98+
99+
An attacker could craft a malicious artifact that writes dangerous environment variables:
100+
101+
```bash
102+
- run: |
103+
echo -e "666\nNEW_ENV_VAR=MALICIOUS_VALUE" > pr-number.txt
104+
- uses: actions/upload-artifact@v4
105+
with:
106+
name: pr-number
107+
path: ./pr-number.txt
108+
```
109+
110+
### Exploitation
111+
112+
An attacker will be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
113+
114+
## References
115+
116+
- [Workflow commands for GitHub Actions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions)
117+
- [GitHub Actions Exploitation: Repo Jacking and Environment Manipulation](https://www.synacktiv.com/publications/github-actions-exploitation-repo-jacking-and-environment-manipulation)

‎ql/src/Security/CWE-077/EnvVarInjectionMedium.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# Environment Variable Injection
2+
3+
## Description
4+
5+
GitHub Actions allows to define Environment Variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
6+
7+
This file should lines in the `KEY=VALUE` format:
8+
9+
```bash
10+
steps:
11+
- name: Set the value
12+
id: step_one
13+
run: |
14+
echo "action_state=yellow" >> "$GITHUB_ENV"
15+
```
16+
17+
It is also possible to define a multiline variables by using the following format:
18+
19+
```
20+
KEY<<{delimiter}
21+
VALUE
22+
VALUE
23+
{delimiter}
24+
```
25+
26+
```bash
27+
steps:
28+
- name: Set the value in bash
29+
id: step_one
30+
run: |
31+
{
32+
echo 'JSON_RESPONSE<<EOF'
33+
curl https://example.com
34+
echo EOF
35+
} >> "$GITHUB_ENV"
36+
```
37+
38+
If an attacker can control the contents of the values assigned to these variables and these are not properly sanitized, they will be able to inject additional variables by injecting new lines or `{delimiters}`.
39+
40+
## Recommendations
41+
42+
1. **Do Not Allow Untrusted Data to Influence Environment Variables**:
43+
44+
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45+
- Validate and sanitize all inputs before using them in environment settings.
46+
47+
2. **Do Not Allow New Lines When Defining Single Line Environment Variables**:
48+
49+
- `echo "BODY=$(echo "$BODY" | tr -d '\n')" >> "$GITHUB_ENV"`
50+
51+
3. **Use Unique Identifiers When Defining Multi Line Environment Variables**:
52+
53+
```bash
54+
steps:
55+
- name: Set the value in bash
56+
id: step_one
57+
run: |
58+
# Generate a UUID
59+
UUID=$(uuidgen)
60+
{
61+
echo "JSON_RESPONSE<<EOF$UUID"
62+
curl https://example.com
63+
echo "EOF$UUID"
64+
} >> "$GITHUB_ENV"
65+
```
66+
67+
## Examples
68+
69+
### Example of Vulnerability
70+
71+
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
72+
73+
```yaml
74+
steps:
75+
- name: Set the value
76+
id: step_one
77+
env:
78+
BODY: ${{ github.event.comment.body }}
79+
run: |
80+
REPLACED=$(echo "$BODY" | sed 's/FOO/BAR/g')
81+
echo "BODY=$REPLACED" >> "$GITHUB_ENV"
82+
```
83+
84+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially inject new Environment variables. For example, they could write an Issue comment like:
85+
86+
```
87+
FOO
88+
NEW_ENV_VAR=MALICIOUS_VALUE
89+
```
90+
91+
Likewise, if the attacker controls a file in the Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact), and the contents of that file are assigned to an environment variable such as:
92+
93+
```bash
94+
- run: |
95+
PR_NUMBER=$(cat pr-number.txt)
96+
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
97+
```
98+
99+
An attacker could craft a malicious artifact that writes dangerous environment variables:
100+
101+
```bash
102+
- run: |
103+
echo -e "666\nNEW_ENV_VAR=MALICIOUS_VALUE" > pr-number.txt
104+
- uses: actions/upload-artifact@v4
105+
with:
106+
name: pr-number
107+
path: ./pr-number.txt
108+
```
109+
110+
### Exploitation
111+
112+
An attacker will be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
113+
114+
## References
115+
116+
- [Workflow commands for GitHub Actions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions)
117+
- [GitHub Actions Exploitation: Repo Jacking and Environment Manipulation](https://www.synacktiv.com/publications/github-actions-exploitation-repo-jacking-and-environment-manipulation)

‎ql/src/Security/CWE-088/ArgumentInjectionCritical.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Argument Injection in GitHub Actions
2+
3+
## Description
4+
5+
Passing user-controlled arguments to certain commands in the context of `Run` steps may lead to arbitrary code execution.
6+
7+
Argument injection in GitHub Actions may allow an attacker to exfiltrate any secrets used in the workflow and the temporary GitHub repository authorization token. The token might have write access to the repository, allowing an attacker to use the token to make changes to the repository.
8+
9+
## Recommendations
10+
11+
When possible avoid passing user-controlled data to commands which may spawn new processes using some of their arguments.
12+
13+
It is also recommended to limit the permissions of any tokens used by a workflow such as the GITHUB_TOKEN.
14+
15+
## Examples
16+
17+
### Incorrect Usage
18+
19+
The following example lets a user inject an arbitrary shell command through argument injection:
20+
21+
```yaml
22+
on: issue_comment
23+
24+
jobs:
25+
echo-body:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- env:
29+
BODY: ${{ github.event.comment.body }}
30+
run: |
31+
cat file.txt | sed "s/BODY_PLACEHOLDER/$BODY/g" > replaced.txt
32+
```
33+
34+
An attacker may set the body of an Issue comment to `BAR|g;1e whoami;#` and the command `whoami` will get executed during the `sed` operation.
35+
36+
## References
37+
38+
- [Common Weakness Enumeration: CWE-88](https://cwe.mitre.org/data/definitions/88.html).
39+
- [Argument Injection Explained](https://sonarsource.github.io/argument-injection-vectors/explained/)
40+
- [Argument Injection Vectors](https://sonarsource.github.io/argument-injection-vectors/)
41+
- [GTFOBins](https://gtfobins.github.io/)

‎ql/src/Security/CWE-088/ArgumentInjectionMedium.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Argument Injection in GitHub Actions
2+
3+
## Description
4+
5+
Passing user-controlled arguments to certain commands in the context of `Run` steps may lead to arbitrary code execution.
6+
7+
Argument injection in GitHub Actions may allow an attacker to exfiltrate any secrets used in the workflow and the temporary GitHub repository authorization token. The token might have write access to the repository, allowing an attacker to use the token to make changes to the repository.
8+
9+
## Recommendations
10+
11+
When possible avoid passing user-controlled data to commands which may spawn new processes using some of their arguments.
12+
13+
It is also recommended to limit the permissions of any tokens used by a workflow such as the GITHUB_TOKEN.
14+
15+
## Examples
16+
17+
### Incorrect Usage
18+
19+
The following example lets a user inject an arbitrary shell command through argument injection:
20+
21+
```yaml
22+
on: issue_comment
23+
24+
jobs:
25+
echo-body:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- env:
29+
BODY: ${{ github.event.comment.body }}
30+
run: |
31+
cat file.txt | sed "s/BODY_PLACEHOLDER/$BODY/g" > replaced.txt
32+
```
33+
34+
An attacker may set the body of an Issue comment to `BAR|g;1e whoami;#` and the command `whoami` will get executed during the `sed` operation.
35+
36+
## References
37+
38+
- [Common Weakness Enumeration: CWE-88](https://cwe.mitre.org/data/definitions/88.html).
39+
- [Argument Injection Explained](https://sonarsource.github.io/argument-injection-vectors/explained/)
40+
- [Argument Injection Vectors](https://sonarsource.github.io/argument-injection-vectors/)
41+
- [GTFOBins](https://gtfobins.github.io/)

0 commit comments

Comments
 (0)