CVE-2023-27581: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-03-13T21:15Z
Repository: https://github.com/rlespinasse/github-slug-action
Language: YAML
Files changed: action.yml
Commit date: 2023-02-20 11:57:12 +0100
Commit message: fix: use github.head_ref env var as trusted input


Diff: diff --git a/action.yml b/action.yml
index ef5e166..6c540ac 100644
--- a/action.yml
+++ b/action.yml
@@ -24,10 +24,11 @@ runs:
       shell: bash
       env:
         INPUT_SLUG_MAXLENGTH: ${{ inputs.slug-maxlength }}
         INPUT_SHORT_LENGTH: ${{ inputs.short-length }}
 
+    # From Environment Variables
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY
         value: ${{ github.repository }}
         prefix: ${{ inputs.prefix }}
@@ -46,34 +47,29 @@ runs:
       with:
         key: GITHUB_BASE_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Specific values
+    # From Specific values
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_EVENT_REF
         value: ${{ github.event.ref }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-
-    # Calculated values
-    - id: get-github-ref-name
-      run: |
-        refname="${{ github.head_ref || github.ref_name }}"
-        if [ -f "$GITHUB_OUTPUT" ]; then
-          echo "github-ref-name=${refname}" >> "$GITHUB_OUTPUT"
-        else
-          echo "::set-output name=github-ref-name::${refname}"
-        fi
-      shell: bash
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF_NAME
-        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
+        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
+        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
+      env:
+        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
+        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}
+
+    # From Calculated values
     - id: get-github-repository-owner-part
       run: |
         ownerpart=$(echo $GITHUB_REPOSITORY | cut -d/ -f1)
         if [ -f "$GITHUB_OUTPUT" ]; then
           echo "github-repository-owner-part=${ownerpart}" >> "$GITHUB_OUTPUT"
@@ -101,11 +97,11 @@ runs:
         key: GITHUB_REPOSITORY_NAME_PART
         value: ${{ steps.get-github-repository-name-part.outputs.github-repository-name-part }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Short
+    # From sha
     - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_SHA
         short-on-error: true
         length: ${{ steps.prefligth.outputs.PREFLIGHT_SHORT_LENGTH }}

Vulnerable code:     # Specific values

    # Calculated values
    - id: get-github-ref-name
      run: |
        refname="${{ github.head_ref || github.ref_name }}"
        if [ -f "$GITHUB_OUTPUT" ]; then
          echo "github-ref-name=${refname}" >> "$GITHUB_OUTPUT"
        else
          echo "::set-output name=github-ref-name::${refname}"
        fi
      shell: bash
        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
    # Short
Fixed code:     # From Environment Variables
    # From Specific values
        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
      env:
        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}

    # From Calculated values
    # From sha