Log in Start free

Vulnerability · Published Apr 24, 2023 · Assigned by GitHub_M

CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

High 8.8

In plain English

A high-severity OS command injection in Kiwi from kiwitcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.6%top 10.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIkiwitcms12.3PYSEC-2023-273

Affected products (as reported)

VendorProductVersions
kiwitcms Kiwi <= 12.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References