Vulnerability · Published Mar 13, 2023 · Assigned by GitHub_M

CVE-2023-27581github-slug-action vulnerable to arbitrary code execution

High 8.8

In plain English

A high-severity command injection in github-slug-action from rlespinasse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.6%top 24.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.

Affected products (as reported)

Vendor	Product	Versions
rlespinasse	github-slug-action	>= 4.0.0, < 4.4.1

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w x_refsource_CONFIRM
https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94 x_refsource_MISC
https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1 x_refsource_MISC
https://securitylab.github.com/research/github-actions-untrusted-input/ x_refsource_MISC