CVE-2023-30628: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-04-24T22:15Z
Repository: https://github.com/kiwitcms/Kiwi
Language: YAML
Files changed: .github/workflows/changelog.yml
Commit date: 2023-04-24 18:15:36 +0300
Commit message: Pass untrusted input via intermediate ENV vars in CI jobs

Diff: diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index bc7f92e32c..59386d5657 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -11,24 +11,27 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
 
     - name: check-source-branch-and-modified-files
+      env:
+        HEAD_REF: ${{ github.head_ref }}
+        DIFF_URL: ${{ github.event.pull_request.diff_url }}
       run: |
         # fail if curl fails
         set -e
 
-        echo "INFO: source branch is: ${{ github.head_ref }}"
+        echo "INFO: source branch is: $HEAD_REF"
         echo "INFO: modified files"
-        curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git"
+        curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git"
 
         set +e
 
         # if this PR modifies the CHANGELOG file it needs to come from a branch
         # that follows the pattern 'prepare/vX.Y' b/c we want to run some extra jobs for such branches!
-        if curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
-            if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then
+        if curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
+            if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then
                 echo "FAIL: Modifications to CHANGELOG are only accepted from 'prepate/vX.Y' branches!"
                 echo "INFO: Otherwise aarch64 jobs in Circle CI will not be executed."
                 exit 1
             fi
         fi

Vulnerable code:         echo "INFO: source branch is: ${{ github.head_ref }}"
        curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git"
        if curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
            if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then
Fixed code:       env:
        HEAD_REF: ${{ github.head_ref }}
        DIFF_URL: ${{ github.event.pull_request.diff_url }}
        echo "INFO: source branch is: $HEAD_REF"
        curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git"
        if curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
            if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then