GSD-2023-22726
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-22726",
"id": "GSD-2023-22726"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-22726"
],
"details": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.",
"id": "GSD-2023-22726",
"modified": "2023-12-13T01:20:42.613457Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-22726",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "act",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "\u003c 0.2.40"
}
]
}
}
]
},
"vendor_name": "nektos"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually."
}
]
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-434",
"lang": "eng",
"value": "CWE-434: Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff",
"refsource": "MISC",
"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff"
},
{
"name": "https://github.com/nektos/act/issues/1553",
"refsource": "MISC",
"url": "https://github.com/nektos/act/issues/1553"
},
{
"name": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10",
"refsource": "MISC",
"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10"
},
{
"name": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65",
"refsource": "MISC",
"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245",
"refsource": "MISC",
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2",
"refsource": "MISC",
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2"
},
{
"name": "https://securitylab.github.com/advisories/GHSL-2023-004_act/",
"refsource": "MISC",
"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/"
}
]
},
"source": {
"advisory": "GHSA-pc99-qmg4-rcff",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003cv0.2.40",
"affected_versions": "All versions before 0.2.40",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-22",
"CWE-937"
],
"date": "2023-02-03",
"description": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.",
"fixed_versions": [
"v0.2.40"
],
"identifier": "CVE-2023-22726",
"identifiers": [
"CVE-2023-22726",
"GHSA-pc99-qmg4-rcff"
],
"not_impacted": "",
"package_slug": "go/github.com/nektos/act",
"pubdate": "2023-01-20",
"solution": "Upgrade to version 0.2.40 or above.",
"title": "Unrestricted Upload of File with Dangerous Type",
"urls": [
"https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff",
"https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10",
"https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2",
"https://github.com/nektos/act/releases/tag/v0.2.40",
"https://github.com/advisories/GHSA-pc99-qmg4-rcff"
],
"uuid": "787d7599-63a7-419b-b4c5-080f6a81ca53",
"versions": [
{
"commit": {
"sha": "9e5ecdd56cfb2e3567298f8ffce4f41aecd2f6bc",
"tags": [
"v0.2.40"
],
"timestamp": "20230116213504"
},
"number": "v0.2.40"
}
]
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:act_project:act:*:*:*:*:*:go:*:*",
"cpe_name": [],
"versionEndExcluding": "0.2.40",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-22726"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://securitylab.github.com/advisories/GHSL-2023-004_act/",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/"
},
{
"name": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65"
},
{
"name": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2"
},
{
"name": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10"
},
{
"name": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245"
},
{
"name": "https://github.com/nektos/act/issues/1553",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/nektos/act/issues/1553"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-02-03T15:56Z",
"publishedDate": "2023-01-20T22:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…