Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
Date: 2024-11
Affected: actions/step-security/harden-runner
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2024-52587
CWE: CWE-78
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Summary Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. ### Details 1. setup.ts:169 [1] performs `execSync` with a command that gets invoked after interpretation by the shell. This command includes an interpolated `process.env.USER` variable, which an attacker could modify (without actually creating a new user) to inject arbitrary shell expressions into this `execSync`. This may or may not be likely in practice, but I believe the hygienic way to perform the underlying operation is to use `execFileSync` or similar and bypass the underlying shell evaluation. 2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above, but with `$USER` for shell-level interpolation rather than string interpolation. However, this is still injectable and would be best replaced by an `execFileSync`, per above. 3. arc-runner:40-44 [3] has an `execSync` with multiple string interpolations. Most of these do not appear immediately injectible (since they appear to come from presumed trusted API responses), but the expansion of `getRunnerTempDir()


Mitigations:

Architectural layers (MAESTRO):