CVE-2023-22726 (GCVE-0-2023-22726)
Vulnerability from cvelistv5 – Published: 2023-01-20 21:02 – Updated: 2025-03-10 21:21
VLAI?
Title
Unrestricted file upload leading to privilege escalation in act
Summary
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.
Severity ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:13:50.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff"
},
{
"name": "https://github.com/nektos/act/issues/1553",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nektos/act/issues/1553"
},
{
"name": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10"
},
{
"name": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2"
},
{
"name": "https://securitylab.github.com/advisories/GHSL-2023-004_act/",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22726",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T21:01:07.479449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:21:14.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "act",
"vendor": "nektos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-20T21:02:35.083Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff"
},
{
"name": "https://github.com/nektos/act/issues/1553",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nektos/act/issues/1553"
},
{
"name": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10"
},
{
"name": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2"
},
{
"name": "https://securitylab.github.com/advisories/GHSL-2023-004_act/",
"tags": [
"x_refsource_MISC"
],
"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/"
}
],
"source": {
"advisory": "GHSA-pc99-qmg4-rcff",
"discovery": "UNKNOWN"
},
"title": "Unrestricted file upload leading to privilege escalation in act"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-22726",
"datePublished": "2023-01-20T21:02:35.083Z",
"dateReserved": "2023-01-06T14:21:05.890Z",
"dateUpdated": "2025-03-10T21:21:14.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-22726",
"date": "2026-04-24",
"epss": "0.01488",
"percentile": "0.81103"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-22726\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-01-20T22:15:10.533\",\"lastModified\":\"2024-11-21T07:45:18.123\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.\"},{\"lang\":\"es\",\"value\":\"act es un proyecto que permite la ejecuci\u00f3n local de acciones de github. El servidor de artefactos que almacena artefactos de las ejecuciones de Github Action no sanitiza las entradas de ruta. Esto permite a un atacante descargar y sobrescribir archivos arbitrarios en el host desde una Github Action. Este problema puede provocar una escalada de privilegios. El endpoint /upload es vulnerable a path traversal, ya que la ruta del archivo est\u00e1 controlada por el usuario y, en \u00faltima instancia, fluye hacia os.Mkdir y os.Open. El endpoint /artifact es vulnerable a path traversal, ya que la ruta es variable y est\u00e1 controlada por el usuario y, en \u00faltima instancia, el servidor devuelve el archivo especificado. Esto se ha solucionado en la versi\u00f3n 0.2.40. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden, durante la implementaci\u00f3n de Open y OpenAtEnd para FS, asegurarse de usar ValidPath() para verificar el path traversal o limpiar las rutas proporcionadas por el usuario manualmente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:act_project:act:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.2.40\",\"matchCriteriaId\":\"35CF3411-A8C4-4D5C-A1E2-33E19D14DFDC\"}]}]}],\"references\":[{\"url\":\"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/issues/1553\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://securitylab.github.com/advisories/GHSL-2023-004_act/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/issues/1553\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://securitylab.github.com/advisories/GHSL-2023-004_act/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\", \"name\": \"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/nektos/act/issues/1553\", \"name\": \"https://github.com/nektos/act/issues/1553\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\", \"name\": \"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\", \"name\": \"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\", \"name\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\", \"name\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://securitylab.github.com/advisories/GHSL-2023-004_act/\", \"name\": \"https://securitylab.github.com/advisories/GHSL-2023-004_act/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T10:13:50.194Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-22726\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-10T21:01:07.479449Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-10T21:01:08.798Z\"}}], \"cna\": {\"title\": \"Unrestricted file upload leading to privilege escalation in act\", \"source\": {\"advisory\": \"GHSA-pc99-qmg4-rcff\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"nektos\", \"product\": \"act\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.2.40\"}]}], \"references\": [{\"url\": \"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\", \"name\": \"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nektos/act/issues/1553\", \"name\": \"https://github.com/nektos/act/issues/1553\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\", \"name\": \"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\", \"name\": \"https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\", \"name\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\", \"name\": \"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://securitylab.github.com/advisories/GHSL-2023-004_act/\", \"name\": \"https://securitylab.github.com/advisories/GHSL-2023-004_act/\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434: Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-01-20T21:02:35.083Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-22726\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-10T21:21:14.383Z\", \"dateReserved\": \"2023-01-06T14:21:05.890Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-01-20T21:02:35.083Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…