Headline
GHSA-2m9h-r57g-45pj: Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
Summary
A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.
Details
This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.
In 2.63.1, gh run download will not download artifacts named .. and . and instead exit with the following error message:
error downloading ..: would result in path traversal
Impact
Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.
Remediation and Mitigation
- Upgrade
ghto2.63.1 - Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as
.., to prevent path traversal risks.
Summary
A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.
Details
This vulnerability stems from a GitHub Actions workflow artifact named … when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named …, the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.
In 2.63.1, gh run download will not download artifacts named … and . and instead exit with the following error message:
error downloading ..: would result in path traversal
Impact
Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.
Remediation and Mitigation
- Upgrade gh to 2.63.1
- Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as …, to prevent path traversal risks.
References
- GHSA-2m9h-r57g-45pj
- cli/cli@1136764