Description
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rlespinasse github-slug-action
>= 4.0.0, < 4.4.1affected
References
- https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w ↗
- https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94 ↗
- https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1 ↗
- https://securitylab.github.com/research/github-actions-untrusted-input/ ↗