CVE-2023-52137
GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames
In short
A GitHub action that checks for changed files can be tricked into running malicious commands if filenames contain special characters like semicolons. An attacker could use this to steal secrets or take control of the build server.
Technical detail
Command injection vulnerability in tj-actions/verify-changed-files where unescaped filenames in action output are directly substituted into shell run blocks. Attack vector requires filenames with shell metacharacters (e.g., `;`) in a repository; impact includes arbitrary code execution and potential credential exfiltration if GITHUB_TOKEN is accessible. Mitigated in v17+ by enabling safe_output and escaping special characters.
Summary generated and translated by AI from the official description.
The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`.
This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Affected products
tj-actions · verify-changed-filesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →