CVE-2023-26493 (published 2023-03-27T22:15Z)

Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/cocos/cocos-engine
commit_details: repo_url: https://github.com/cocos/cocos-engine
author: PP
author_date: 2023-02-21 09:51:08+08:00
msg: remove interface check workflow (#14281)
repository: repo_url: https://github.com/cocos/cocos-engine
repo_name: cocos/cocos-engine
description: Cocos simplifies game creation and distribution with Cocos Creator, a free, open-source, cross-platform game engine. Empowering millions of developers to create high-performance, engaging 2D/3D games and instant web entertainment.
repo_language: C++
owner: cocos
file_changes: filename: interface-check-report.js
change_type: ModificationType.DELETE
diff: @@ -1,20 +0,0 @@
-const ps = require('path');
-const fs = require('fs');
-
-const interfaceDiffPath = ps.join(__dirname, '../../interface-diff.txt');
-let reportContent = fs.readFileSync(interfaceDiffPath, 'utf8');
-
-if (reportContent.includes('@')) {
-    reportContent = reportContent.split('\n').slice(3).join('\n');
-    reportContent = `## Interface Check Report
-\`\`\`diff
-! WARNING this pull request has changed these public interfaces:
-
-${reportContent}
-\`\`\`
-`;
-} else {
-    reportContent = `## Interface Check Report
-This pull request does not change any public interfaces !`;
-}
-fs.writeFileSync(interfaceDiffPath, reportContent, 'utf8');

programming_language: unknown
filename: web-interface-check.yml
change_type: ModificationType.DELETE
diff: @@ -1,87 +0,0 @@
-name: <Web> Interface check
-
-#on: push
-on: [pull_request_target]
-
-# github.head_ref is only defined on pull_request events
-concurrency:
-  group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  interface_check:
-    permissions: read-all|write-all
-    if: 
-      (! contains(github.event.pull_request.body, '[X] does not change any runtime related code or build configuration'))
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '14.19'
-
-      - name: clone REPO
-        run: |
-          git config --global user.name "test"
-          git config --global user.email "test@test.com"
-          git clone https://github.com/cocos-creator/engine.git
-      
-      - name: checkout BASE branch
-        working-directory: ./engine
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          git checkout -b ${{ github.base_ref }}_BASE remotes/origin/${{ github.base_ref }}
-          git branch
-
-      - name: npm install BASE branch
-        working-directory: ./engine
-        run: |
-          npm install --ignore-scripts
-
-      - name: build BASE declaration
-        working-directory: ./engine
-        run: |
-          npm run build-declaration
-          cp ./bin/.declarations/cc.d.ts ../cc_base.d.ts
-
-      - name: clear dependencies
-        working-directory: ./engine
-        run: |
-          git checkout .
-          git clean -xfd
-          npm cache clean --force
-          ls -la
-
-      - name: merge HEAD branch
-        working-directory: ./engine
-        run: |
-          git remote add HEAD_REPO https://github.com/${{ github.event.pull_request.head.repo.full_name }}.git
-          git fetch HEAD_REPO ${{ github.head_ref }}
-          git merge remotes/HEAD_REPO/${{ github.head_ref }}
-
-      - name: npm install HEAD branch
-        working-directory: ./engine
-        run: |
-          npm install --ignore-scripts
-
-      - name: build HEAD declaration
-        working-directory: ./engine
-        run: |
-          npm run build-declaration
-
-      - uses: LouisBrunner/diff-action@v0.1.2
-        with:
-          old: ./cc_base.d.ts
-          new: ./engine/bin/.declarations/cc.d.ts
-          mode: addition
-          tolerance: worse
-          output: ./engine/interface-diff.txt
-
-      - name: optimize interface check report
-        working-directory: ./engine
-        run: |
-          cat ./interface-diff.txt
-          node ./.github/workflows/interface-check-report.js
-
-      - uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          path: ./engine/interface-diff.txt

programming_language: unknown