You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ql/src/Security/CWE-077/EnvPathInjectionCritical.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## Description
4
4
5
-
GitHub Actions allow to define the system PATH variable by writing to a file pointed by the `GITHUB_PATH` environment variable. Writing to this file appends a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job.
5
+
GitHub Actions allow to define the system PATH variable by writing to a file pointed to by the `GITHUB_PATH` environment variable. Writing to this file appends a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job.
Copy file name to clipboardExpand all lines: ql/src/Security/CWE-077/EnvPathInjectionMedium.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## Description
4
4
5
-
GitHub Actions allow to define the system PATH variable by writing to a file pointed by the `GITHUB_PATH` environment variable. Writing to this file appends a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job.
5
+
GitHub Actions allow to define the system PATH variable by writing to a file pointed to by the `GITHUB_PATH` environment variable. Writing to this file appends a directory to the system PATH variable and automatically makes it available to all subsequent actions in the current job.
Copy file name to clipboardExpand all lines: ql/src/Security/CWE-077/EnvVarInjectionCritical.md
+29-29Lines changed: 29 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
3
3
## Description
4
4
5
-
GitHub Actions allow to define Environment Variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
5
+
GitHub Actions allow to define environment variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
6
6
7
-
This file should lines in the `KEY=VALUE` format:
7
+
This file contains lines in the `KEY=VALUE` format:
8
8
9
9
```bash
10
10
steps:
@@ -14,7 +14,7 @@ steps:
14
14
echo"action_state=yellow">>"$GITHUB_ENV"
15
15
```
16
16
17
-
It is also possible to define a multiline variables by using the following format:
17
+
It is also possible to define multiline variables by using the [following construct](https://en.wikipedia.org/wiki/Here_document):
18
18
19
19
```
20
20
KEY<<{delimiter}
@@ -35,40 +35,40 @@ steps:
35
35
} >>"$GITHUB_ENV"
36
36
```
37
37
38
-
If an attacker can control the contents of the values assigned to these variables and these are not properly sanitized, they will be able to inject additional variables by injecting new lines or `{delimiters}`.
38
+
If an attacker can control the values assigned to environment variables and there is no sanitization in place, the attacker will be able to inject additional variables by injecting new lines or `{delimiters}`.
39
39
40
40
## Recommendations
41
41
42
-
1.**Do Not Allow Untrusted Data to Influence Environment Variables**:
42
+
1.**Do not allow untrusted data to influence environment variables**:
43
43
44
-
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45
-
- Validate and sanitize all inputs before using them in environment settings.
44
+
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45
+
- Validate and sanitize all inputs before using them in environment settings.
46
46
47
-
2.**Do Not Allow New Lines When Defining Single Line Environment Variables**:
47
+
2.**Do not allow new lines when defining single line environment variables**:
3.**Use Unique Identifiers When Defining Multi Line Environment Variables**:
51
+
3.**Use unique identifiers when defining multi line environment variables**:
52
52
53
-
```bash
54
-
steps:
55
-
- name: Set the value in bash
56
-
id: step_one
57
-
run: |
58
-
# Generate a UUID
59
-
UUID=$(uuidgen)
60
-
{
61
-
echo"JSON_RESPONSE<<EOF$UUID"
62
-
curl https://example.com
63
-
echo"EOF$UUID"
64
-
} >>"$GITHUB_ENV"
65
-
```
53
+
```bash
54
+
steps:
55
+
- name: Set the value in bash
56
+
id: step_one
57
+
run: |
58
+
# Generate a UUID
59
+
UUID=$(uuidgen)
60
+
{
61
+
echo"JSON_RESPONSE<<EOF$UUID"
62
+
curl https://example.com
63
+
echo"EOF$UUID"
64
+
} >>"$GITHUB_ENV"
65
+
```
66
66
67
67
## Examples
68
68
69
69
### Example of Vulnerability
70
70
71
-
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
71
+
Consider the following basic setup where an environment variable `MYVAR` is set and used insubsequent steps:
72
72
73
73
```yaml
74
74
steps:
@@ -78,17 +78,17 @@ steps:
78
78
BODY: ${{ github.event.comment.body }}
79
79
run: |
80
80
REPLACED=$(echo "$BODY"| sed 's/FOO/BAR/g')
81
-
echo "BODY=$REPLACED" >> "$GITHUB_ENV"
81
+
echo"MYVAR=$REPLACED">>"$GITHUB_ENV"
82
82
```
83
83
84
-
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially inject new Environment variables. For example, they could write an Issue comment like:
84
+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, the attacker can potentially inject new environment variables. For example, they could write an issue comment like:
85
85
86
-
```
86
+
```text
87
87
FOO
88
88
NEW_ENV_VAR=MALICIOUS_VALUE
89
89
```
90
90
91
-
Likewise, if the attacker controls a file in the Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact), and the contents of that file are assigned to an environment variable such as:
91
+
Likewise, if the attacker controls a file in the GitHub Actions Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact) and the contents of that file are assigned to an environment variable such as:
92
92
93
93
```bash
94
94
- run: |
@@ -109,7 +109,7 @@ An attacker could craft a malicious artifact that writes dangerous environment v
109
109
110
110
### Exploitation
111
111
112
-
An attacker will be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
112
+
An attacker is be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
Copy file name to clipboardExpand all lines: ql/src/Security/CWE-077/EnvVarInjectionMedium.md
+29-29Lines changed: 29 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
3
3
## Description
4
4
5
-
GitHub Actions allow to define Environment Variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
5
+
GitHub Actions allow to define environment variables by writing to a file pointed to by the `GITHUB_ENV` environment variable:
6
6
7
-
This file should lines in the `KEY=VALUE` format:
7
+
This file contains lines in the `KEY=VALUE` format:
8
8
9
9
```bash
10
10
steps:
@@ -14,7 +14,7 @@ steps:
14
14
echo"action_state=yellow">>"$GITHUB_ENV"
15
15
```
16
16
17
-
It is also possible to define a multiline variables by using the following format:
17
+
It is also possible to define multiline variables by using the [following construct](https://en.wikipedia.org/wiki/Here_document):
18
18
19
19
```
20
20
KEY<<{delimiter}
@@ -35,40 +35,40 @@ steps:
35
35
} >>"$GITHUB_ENV"
36
36
```
37
37
38
-
If an attacker can control the contents of the values assigned to these variables and these are not properly sanitized, they will be able to inject additional variables by injecting new lines or `{delimiters}`.
38
+
If an attacker can control the values assigned to environment variables and there is no sanitization in place, the attacker will be able to inject additional variables by injecting new lines or `{delimiters}`.
39
39
40
40
## Recommendations
41
41
42
-
1.**Do Not Allow Untrusted Data to Influence Environment Variables**:
42
+
1.**Do not allow untrusted data to influence environment variables**:
43
43
44
-
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45
-
- Validate and sanitize all inputs before using them in environment settings.
44
+
- Avoid using untrusted data sources (e.g., artifact content) to define environment variables.
45
+
- Validate and sanitize all inputs before using them in environment settings.
46
46
47
-
2.**Do Not Allow New Lines When Defining Single Line Environment Variables**:
47
+
2.**Do not allow new lines when defining single line environment variables**:
3.**Use Unique Identifiers When Defining Multi Line Environment Variables**:
51
+
3.**Use unique identifiers when defining multi line environment variables**:
52
52
53
-
```bash
54
-
steps:
55
-
- name: Set the value in bash
56
-
id: step_one
57
-
run: |
58
-
# Generate a UUID
59
-
UUID=$(uuidgen)
60
-
{
61
-
echo"JSON_RESPONSE<<EOF$UUID"
62
-
curl https://example.com
63
-
echo"EOF$UUID"
64
-
} >>"$GITHUB_ENV"
65
-
```
53
+
```bash
54
+
steps:
55
+
- name: Set the value in bash
56
+
id: step_one
57
+
run: |
58
+
# Generate a UUID
59
+
UUID=$(uuidgen)
60
+
{
61
+
echo"JSON_RESPONSE<<EOF$UUID"
62
+
curl https://example.com
63
+
echo"EOF$UUID"
64
+
} >>"$GITHUB_ENV"
65
+
```
66
66
67
67
## Examples
68
68
69
69
### Example of Vulnerability
70
70
71
-
Consider the following basic setup where an environment variable `MYVAR` is set and used in different steps:
71
+
Consider the following basic setup where an environment variable `MYVAR` is set and used insubsequent steps:
72
72
73
73
```yaml
74
74
steps:
@@ -78,17 +78,17 @@ steps:
78
78
BODY: ${{ github.event.comment.body }}
79
79
run: |
80
80
REPLACED=$(echo "$BODY"| sed 's/FOO/BAR/g')
81
-
echo "BODY=$REPLACED" >> "$GITHUB_ENV"
81
+
echo"MYVAR=$REPLACED">>"$GITHUB_ENV"
82
82
```
83
83
84
-
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, they can potentially inject new Environment variables. For example, they could write an Issue comment like:
84
+
If an attacker can manipulate the value being set, such as through artifact downloads or user inputs, the attacker can potentially inject new environment variables. For example, they could write an issue comment like:
85
85
86
-
```
86
+
```text
87
87
FOO
88
88
NEW_ENV_VAR=MALICIOUS_VALUE
89
89
```
90
90
91
-
Likewise, if the attacker controls a file in the Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact), and the contents of that file are assigned to an environment variable such as:
91
+
Likewise, if the attacker controls a file in the GitHub Actions Runner's workspace (eg: the workflow checkouts untrusted code or downloads an untrusted artifact) and the contents of that file are assigned to an environment variable such as:
92
92
93
93
```bash
94
94
- run: |
@@ -109,7 +109,7 @@ An attacker could craft a malicious artifact that writes dangerous environment v
109
109
110
110
### Exploitation
111
111
112
-
An attacker will be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
112
+
An attacker is be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
0 commit comments