GHSA-5xr6-xhww-33m4: Dawidd6/action download artifact Artifact Poisoning Vulnerability Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5xr6-xhww-33m4",
  "modified" : "2024-11-25T15:26:43Z",
  "published" : "2024-11-25T15:26:43Z",
  "aliases" : [ ],
  "summary" : "Artifact poisoning vulnerability in action-download-artifact v5 and earlier",
  "details" : "### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).\n",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "GitHub Actions",
      "name" : "dawidd6/action-download-artifact"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dawidd6/action-download-artifact"
  }, {
    "type" : "WEB",
    "url" : "https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-349" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-25T15:26:43Z",
    "nvd_published_at" : null
  }
}