Vulnerability · Published Jan 2, 2024 · Assigned by GitHub_M

CVE-2024-21623Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets

Critical 9.8

In plain English

A critical-severity injection in otclient from mehah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 31.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.

Affected products (as reported)

Vendor	Product	Versions
mehah	otclient	< db560de0b56476c87a2f967466407939196dd254

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589 x_refsource_CONFIRM
https://github.com/mehah/otclient/commit/db560de0b56476c87a2f967466407939196dd254 x_refsource_MISC
https://github.com/mehah/otclient/blob/72744edc3b9913b920e0fd12e929604f682fda75/.github/workflows/analysis-sonarcloud.yml#L91-L104 x_refsource_MISC
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ x_refsource_MISC
https://securitylab.github.com/research/github-actions-untrusted-input/ x_refsource_MISC