Log in Start free

Vulnerability · Published Jan 20, 2023 · Assigned by GitHub_M

CVE-2023-22726Unrestricted file upload leading to privilege escalation in act

High 8.0

In plain English

A high-severity unrestricted file upload in act from nektos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)1.3%top 29.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/nektos/act0.2.40GHSA-pc99-qmg4-rcff
Gogithub.com/nektos/act0.2.40GO-2023-1504

Affected products (as reported)

VendorProductVersions
nektos act < 0.2.40

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References