Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-29220— No verification of commits origin in github-action-merge-dependabot

Quick assessment

Affected
fastify github-action-merge-dependabot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

github-action-merge-dependabot是用于自动批准和合并dependabot PR。 github-action-merge-dependabot 3.2.0 之前版本存在安全漏洞，该漏洞源于不会检查是否使用正确的 GPG 密钥验证了dependabot 创建的提交。

CVSS 6.5 · Medium EPSS 0.49% · P40
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-29220

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
No verification of commits origin in github-action-merge-dependabot
Source: CVE Program / CVE List V5
Vulnerability Description
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的属主
Source: CVE Program / CVE List V5
Vulnerability Title
github-action-merge-dependabot 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
github-action-merge-dependabot是用于自动批准和合并dependabot PR。 github-action-merge-dependabot 3.2.0 之前版本存在安全漏洞，该漏洞源于不会检查是否使用正确的 GPG 密钥验证了dependabot 创建的提交。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
fastify github-action-merge-dependabot < 3.2.0 -

II. Public POCs for CVE-2022-29220

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-29220

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-29220 (1)

Vendor Advisories for CVE-2022-29220 (1)

Other References for CVE-2022-29220 (1)

IV. Related Vulnerabilities

Same vendor: fastify
Same weakness: CWE-283

V. Comments for CVE-2022-29220

No comments yet

Leave a comment