Project: KICS (Provisioning / Security & Compliance)
File: 62ff6823-927a-427f-acf9-f1ea2932d616.md

title: Script Block Injection hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 62ff6823-927a-427f-acf9-f1ea2932d616 Query name: Script Block Injection Platform: CICD Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: GitHub Actions workflows can be triggered by a variety of events. Every workflow trigger is provided with a GitHub context that contains information about the triggering event, such as which user triggered it, the branch name, and other event context details. Some of this event data, like the base repository name, hash value of a changeset, or pull request number, is unlikely to be controlled or used for injection by the user that triggered the event.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17" name: test-script-run on: issues: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.issue.title }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="17" name: test-script-run on: pullrequesttarget: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.pull_request.title }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="17" name: test-script-run on: issue_comment: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.issue.title }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="17" name: test-script-run on: discussion: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.discussion.title }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="17" name: test-script-run on: discussion_comment: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.discussion.title }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Positive test

6 - yaml file</summary> ```yaml hl_lines="17" name: test-script-run on: workflow_run: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.workflow.path }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Positive test num. 7 - yaml file</summary> ```yaml hl_lines="17" name: test-script-run on: author: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | const fs = require('fs'); const body = fs.readFileSync('/tmp/${{ github.event.authors.name }}.txt', {encoding: 'utf8'}); await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> ```yaml title="Negative test num. 1 - yaml file" name: test-script-run on: issues: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` ```yaml title="Negative test num. 2 - yaml file" name: test-script-run on: pullrequesttarget: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` ```yaml title="Negative test num. 3 - yaml file" name: test-script-run on: issue_comment: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml name: test-script-run on: discussion: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml name: test-script-run on: discussion_comment: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Negative test num. 6 - yaml file</summary> ```yaml name: test-script-run on: workflow_run: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details> <details><summary>Negative test num. 7 - yaml file</summary> ```yaml name: test-script-run on: author: types: [opened] jobs: script-run: runs-on: ubuntu-latest steps: name: Checkout uses: actions/checkout@v4 name: Run script uses: actions/github-script@latest with: script: | await github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'Thanks for reporting!' }) return true; ``` </details>