GitHub Actions Command Injection Vulnerability (CWE-94) Analysis and Remediation

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - ID: js/actions/command-injection - Kind: problem - Security severity: 9.3 - Severity: warning - Precision: high 2. Vulnerability Type: - Tags: actions, security, external/cwe/cwe-094 - Query suites: javascript-code-scanning.qls, javascript-security-extended.qls, javascript-security-and-quality.qls 3. Vulnerability Impact: - GitHub Actions: Using user-controlled input may lead to command injection vulnerabilities. - Attack surface of GitHub Actions: Allows attackers to exploit temporary GitHub repository authorization tokens, which may have write access to the repository, enabling them to make changes to the repository using the token. 4. Recommended Actions: - Best Practice: Set untrusted input values as intermediate environment variables, then use native environment variable syntax (instead of ). - Recommendation: Restrict permissions for any tokens used in workflows, such as . 5. Examples: - Example 1: Using environment variables but still allowing injection due to expression syntax. - Example 2: Using shell syntax to read environment variables, thereby preventing attacks. 6. References: - GitHub Security Lab Research: Keeping your GitHub Actions and workflows secure: Untrusted input. - GitHub Docs: Security hardening for GitHub Actions. - GitHub Docs: Permissions for the GITHUB_TOKEN. - Common Weakness Enumeration: CWE-94.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub Actions Command Injection Vulnerability (CWE-94) Analysis and Remediation