Security Digest · Critical advisory (no CVE assigned)
GHSA-phf6-hm3h-x8qp: Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`
Summary Using Issuecomment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
grep -rn 'uses: <owner>/<action>' .github/workflows. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| GitHub Actions | broadinstitute/cromwell | >= 87, < 90 | 90 |
Details
Summary Using Issuecomment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUBTOKEN which can be used to completely overtake the repo since the token has content privileges. In addition ,it is possible to exfiltrate also the secret: - BROADBOTGITHUBTOKEN
Details The Issuecomment in GitHub Actions might be an injection path if the variable isn't handle as it should. In the following step it's vulnerable because it directly interpolates untrusted user input into a shell script.
In this case, it is possible to exfiltrate GITHUBTOKEN and BROADBOTGITHUBTOKEN secrets.
PoC To exploit the vulnerability an attacker can just drop a comment to any issue formed in the following way to exploit the vulnerability in the workflow .github/workflows/updatepylonissue.yml.
To prove this is possible, we created an issue and we added a comment with the malicious code to extract the GITHUBTOKEN and BROADBOTGITHUBTOKEN secret. With the GITHUBTOKEN extracted we were able to push a new poc tag which has been deleted after a couple of minutes.
Impact Usually with GITHUBTOKEN and write permissions, an attacker is able to completely overtake the repo.
We also checked BROADBOTGITHUBTOKEN permission to check if we could move laterally to org level. In this case the token seems scoped to this specific repo but it gives an attacker persistence without the need of a valid GITHUBTOKEN. We suggest to rotate the BROADBOTGITHUBTOKEN token asap.
Fix
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources and references
- GitHub Advisory GHSA-phf6-hm3h-x8qp github.com
- github.com github.com
- github.com github.com
Critical GitHub Actions advisories · Today’s Security Digest