CVE-2023-27581 (published 2023-03-13T21:15Z)

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/rlespinasse/github-slug-action
commit_details: repo_url: https://github.com/rlespinasse/github-slug-action
author: Romain Lespinasse
author_date: 2023-02-20 11:57:12+01:00
msg: fix: use github.head_ref env var as trusted input
repository: repo_url: https://github.com/rlespinasse/github-slug-action
repo_name: rlespinasse/github-slug-action
description: GitHub Action to expose slug value of GitHub environment variables inside your GitHub workflow
repo_language: Shell
owner: rlespinasse
file_changes: filename: action.yml
change_type: ModificationType.MODIFY
diff: @@ -26,6 +26,7 @@ runs:
         INPUT_SLUG_MAXLENGTH: ${{ inputs.slug-maxlength }}
         INPUT_SHORT_LENGTH: ${{ inputs.short-length }}
 
+    # From Environment Variables
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY
@@ -48,30 +49,25 @@ runs:
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Specific values
+    # From Specific values
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_EVENT_REF
         value: ${{ github.event.ref }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-
-    # Calculated values
-    - id: get-github-ref-name
-      run: |
-        refname="${{ github.head_ref || github.ref_name }}"
-        if [ -f "$GITHUB_OUTPUT" ]; then
-          echo "github-ref-name=${refname}" >> "$GITHUB_OUTPUT"
-        else
-          echo "::set-output name=github-ref-name::${refname}"
-        fi
-      shell: bash
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF_NAME
-        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
+        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
+        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
+      env:
+        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
+        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}
+
+    # From Calculated values
     - id: get-github-repository-owner-part
       run: |
         ownerpart=$(echo $GITHUB_REPOSITORY | cut -d/ -f1)
@@ -103,7 +99,7 @@ runs:
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Short
+    # From sha
     - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_SHA

programming_language: Shell