CVE-2023-26493: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-03-27T22:15Z
Repository: https://github.com/cocos/cocos-engine
Language: Unknown
Commit date: 2023-02-21 09:51:08 +0800
Commit message: remove interface check workflow (#14281)


Diff: diff --git a/.github/workflows/interface-check-report.js b/.github/workflows/interface-check-report.js
deleted file mode 100644
index fc3a75829..000000000
--- a/.github/workflows/interface-check-report.js
+++ /dev/null
@@ -1,20 +0,0 @@
-const ps = require('path');
-const fs = require('fs');
-
-const interfaceDiffPath = ps.join(__dirname, '../../interface-diff.txt');
-let reportContent = fs.readFileSync(interfaceDiffPath, 'utf8');
-
-if (reportContent.includes('@')) {
-    reportContent = reportContent.split('\n').slice(3).join('\n');
-    reportContent = `## Interface Check Report
-\`\`\`diff
-! WARNING this pull request has changed these public interfaces:
-
-${reportContent}
-\`\`\`
-`;
-} else {
-    reportContent = `## Interface Check Report
-This pull request does not change any public interfaces !`;
-}
-fs.writeFileSync(interfaceDiffPath, reportContent, 'utf8');
diff --git a/.github/workflows/web-interface-check.yml b/.github/workflows/web-interface-check.yml
deleted file mode 100644
index 18815312c..000000000
--- a/.github/workflows/web-interface-check.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-name: <Web> Interface check
-
-#on: push
-on: [pull_request_target]
-
-# github.head_ref is only defined on pull_request events
-concurrency:
-  group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  interface_check:
-    permissions: read-all|write-all
-    if: 
-      (! contains(github.event.pull_request.body, '[X] does not change any runtime related code or build configuration'))
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '14.19'
-
-      - name: clone REPO
-        run: |
-          git config --global user.name "test"
-          git config --global user.email "test@test.com"
-          git clone https://github.com/cocos-creator/engine.git
-      
-      - name: checkout BASE branch
-        working-directory: ./engine
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          git checkout -b ${{ github.base_ref }}_BASE remotes/origin/${{ github.base_ref }}
-          git branch
-
-      - name: npm install BASE branch
-        working-directory: ./engine
-        run: |
-          npm install --ignore-scripts
-
-      - name: build BASE declaration
-        working-directory: ./engine
-        run: |
-          npm run build-declaration
-          cp ./bin/.declarations/cc.d.ts ../cc_base.d.ts
-
-      - name: clear dependencies
-        working-directory: ./engine
-        run: |
-          git checkout .
-          git clean -xfd
-          npm cache clean --force
-          ls -la
-
-      - name: merge HEAD branch
-        working-directory: ./engine
-        run: |
-          git remote add HEAD_REPO https://github.com/${{ github.event.pull_request.head.repo.full_name }}.git
-          git fetch HEAD_REPO ${{ github.head_ref }}
-          git merge remotes/HEAD_REPO/${{ github.head_ref }}
-
-      - name: npm install HEAD branch
-        working-directory: ./engine
-        run: |
-          npm install --ignore-scripts
-
-      - name: build HEAD declaration
-        working-directory: ./engine
-        run: |
-          npm run build-declaration
-
-      - uses: LouisBrunner/diff-action@v0.1.2
-        with:
-          old: ./cc_base.d.ts
-          new: ./engine/bin/.declarations/cc.d.ts
-          mode: addition
-          tolerance: worse
-          output: ./engine/interface-diff.txt
-
-      - name: optimize interface check report
-        working-directory: ./engine
-        run: |
-          cat ./interface-diff.txt
-          node ./.github/workflows/interface-check-report.js
-
-      - uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          path: ./engine/interface-diff.txt

Vulnerable code: const ps = require('path');
const fs = require('fs');

const interfaceDiffPath = ps.join(__dirname, '../../interface-diff.txt');
let reportContent = fs.readFileSync(interfaceDiffPath, 'utf8');

if (reportContent.includes('@')) {
    reportContent = reportContent.split('\n').slice(3).join('\n');
    reportContent = `## Interface Check Report
\`\`\`diff
! WARNING this pull request has changed these public interfaces:

${reportContent}
\`\`\`
`;
} else {
    reportContent = `## Interface Check Report
This pull request does not change any public interfaces !`;
}
fs.writeFileSync(interfaceDiffPath, reportContent, 'utf8');
name: <Web> Interface check

#on: push
on: [pull_request_target]

# github.head_ref is only defined on pull_request events
concurrency:
  group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  interface_check:
    permissions: read-all|write-all
    if: 
      (! contains(github.event.pull_request.body, '[X] does not change any runtime related code or build configuration'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v2
        with:
          node-version: '14.19'

      - name: clone REPO
        run: |
          git config --global user.name "test"
          git config --global user.email "test@test.com"
          git clone https://github.com/cocos-creator/engine.git
      
      - name: checkout BASE branch
        working-directory: ./engine
        run: |
          git fetch origin ${{ github.base_ref }}
          git checkout -b ${{ github.base_ref }}_BASE remotes/origin/${{ github.base_ref }}
          git branch

      - name: npm install BASE branch
        working-directory: ./engine
        run: |
          npm install --ignore-scripts

      - name: build BASE declaration
        working-directory: ./engine
        run: |
          npm run build-declaration
          cp ./bin/.declarations/cc.d.ts ../cc_base.d.ts

      - name: clear dependencies
        working-directory: ./engine
        run: |
          git checkout .
          git clean -xfd
          npm cache clean --force
          ls -la

      - name: merge HEAD branch
        working-directory: ./engine
        run: |
          git remote add HEAD_REPO https://github.com/${{ github.event.pull_request.head.repo.full_name }}.git
          git fetch HEAD_REPO ${{ github.head_ref }}
          git merge remotes/HEAD_REPO/${{ github.head_ref }}

      - name: npm install HEAD branch
        working-directory: ./engine
        run: |
          npm install --ignore-scripts

      - name: build HEAD declaration
        working-directory: ./engine
        run: |
          npm run build-declaration

      - uses: LouisBrunner/diff-action@v0.1.2
        with:
          old: ./cc_base.d.ts
          new: ./engine/bin/.declarations/cc.d.ts
          mode: addition
          tolerance: worse
          output: ./engine/interface-diff.txt

      - name: optimize interface check report
        working-directory: ./engine
        run: |
          cat ./interface-diff.txt
          node ./.github/workflows/interface-check-report.js

      - uses: marocchino/sticky-pull-request-comment@v2
        with:
          path: ./engine/interface-diff.txt