CVE-2020-15228 PoC — @actions/core 命令注入漏洞

Source

https://github.com/guettli/fix-CVE-2020-15228

Associated Vulnerability

Title:@actions/core 命令注入漏洞 (CVE-2020-15228)
Description:@actions/core是个人开发者的npm包管理工具的核心函数。该函数用于结果、密钥、日志的配置。 npm 模块 @actions/core 1.2.6之前版本存在命令注入漏洞，该漏洞源于addPath和exportVariable函数通过生成特定格式的字符串，通过stdout与Actions Runner通信。将不受信任的数据记录到stdout的工作流可能会调用这些命令，从而导致在工作流或操作作者无意的情况下修改路径或环境变量。

Description

Fix CVE-2020-15228 (set-env, add-path in Github-Actions)

Readme

# Fix CVE-2020-15228 (set-env, add-path in Github-Actions)

This script changes lines in your github action file.

You give it a directory name, and it searches for all files with the ".sh" or ".yml" extension.

It recognizes these lines:

```
echo ::set-env name=FOO_BAR::$FOO_BAR
echo ::set-env name=FOO_BAR::${FOO_BAR}
echo "::set-env name=FOO_BAR::$FOO_BAR"
echo "::set-env name=FOO_BAR::${FOO_BAR}"
```

All lines get rewrites to 
```
echo "FOO_BAR=$FOO_BAR" >> $GITHUB_ENV
```

And
```
run: echo ::set-env name=FOO_BAR::"${GITHUB_SHA::8},dev-${GITHUB_SHA::8}"
```
becomes
```
run: echo "FOO_BAR=${GITHUB_SHA::8},dev-${GITHUB_SHA::8}" >> $GITHUB_ENV
```
# Run

You can apply this script directly like this. All ".sh" and ".yml" files in "your_repo/.github/workflows" get updated.

```
curl -sSL https://raw.githubusercontent.com/guettli/fix-CVE-2020-15228/main/fix_CVE_2020_15228.py | python3 - your_repo/.github/workflows
```

Please give this project a "star" if it was useful to you.

# TODO: add-path

I don't have any working example of `add-path`. Up to now this does not get updated. 

If you tell me the desired transformation, then I can add it. Thank you.

File Snapshot


 [4.0K]  /data/pocs/e447a72d645b3ea93ebd7274acba2d02f591e674
├── [2.5K]  fix_CVE_2020_15228.py
├── [1.0K]  LICENSE
├── [1.1K]  README.md
└── [ 863]  setup.py

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!