CVE-2021-21423 (published 2021-04-06T19:15Z)

`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen\'s `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository. The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made). Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-527
cwe_name: Exposure of Version-Control Repository to an Unauthorized Control Sphere
description: The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
extended_description: Version control repositories such as CVS or git store version-specific metadata and other details within subdirectories. If these subdirectories are stored on a web server or added to an archive, then these could be used by an attacker. This information may include usernames, filenames, path root, IP addresses, and detailed "diff" data about how files have been changed - which could reveal source code snippets that were never intended to be made public.
         

Fix information:
repo_url: https://github.com/projen/projen
commit_details: repo_url: https://github.com/projen/projen
author: Elad Ben-Israel
author_date: 2021-03-09 11:02:36+02:00
msg: fix(node): security vulnerability in rebuild-bot (#602)

To address a security issue, the `@projen rebuild` workflow will no longer be triggered by a comment on the pull request. This commit removes the `issue_comment` trigger from rebuild-bot workflow so that this workflow can only be executed manually by administrators.

Additional details will be provided at a future date.
repository: repo_url: https://github.com/projen/projen
repo_name: projen/projen
description: Rapidly build modern applications with advanced configuration management
repo_language: TypeScript
owner: projen
file_changes: filename: rebuild-bot.yml
change_type: ModificationType.MODIFY
diff: @@ -2,9 +2,6 @@
 
 name: rebuild-bot
 on:
-  issue_comment:
-    types:
-      - created
   workflow_dispatch: {}
 jobs:
   build:

programming_language: Shell
filename: integ.test.ts.snap
change_type: ModificationType.MODIFY
diff: @@ -317,9 +317,6 @@ jobs:
 
 name: rebuild-bot
 on:
-  issue_comment:
-    types:
-      - created
   workflow_dispatch: {}
 jobs:
   build:
@@ -4206,9 +4203,6 @@ jobs:
 
 name: rebuild-bot
 on:
-  issue_comment:
-    types:
-      - created
   workflow_dispatch: {}
 jobs:
   build:

programming_language: CoffeeScript
filename: node-project.ts
change_type: ModificationType.MODIFY
diff: @@ -881,7 +881,13 @@ export class NodeProject extends Project {
 
     const workflow = github.addWorkflow(name);
 
-    workflow.on(options.trigger);
+    if (options.trigger) {
+      if (options.trigger.issue_comment) {
+        throw new Error('"issue_comment" should not be used as a trigger due to a security issue');
+      }
+
+      workflow.on(options.trigger);
+    }
 
     workflow.on({
       workflow_dispatch: {}, // allow manual triggering
@@ -1041,7 +1047,7 @@ export class NodeProject extends Project {
     });
 
     this.createBuildWorkflow('rebuild-bot', {
-      trigger: { issue_comment: { types: ['created'] } },
+      // trigger: { issue_comment: { types: ['created'] } }, // <--- disabled due to a security issue
       condition: `\${{ github.event.issue.pull_request && contains(github.event.comment.body, '@projen ${command}') }}`,
       antitamperDisabled: true, // definitely do not want that
 
@@ -1107,7 +1113,12 @@ interface NodeBuildWorkflowOptions {
    */
   readonly artifactDirectory?: string;
 
-  readonly trigger: { [event: string]: any };
+  /**
+   * What should trigger the workflow?
+   *
+   * @default - by default workflows can only be triggered by manually.
+   */
+  readonly trigger?: { [event: string]: any };
 
   /**
    * Bump a new version for this build.

programming_language: TypeScript