CVE-2024-42471 Arbitrary File Write via artifact extraction in actions/artifact

2024-09-0216:13:50

CWE-22

GitHub_M

www.cve.org

github toolkit

github actions

vulnerability

arbitrary file write

path traversal

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

21.9%

JSON

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of actions/artifact before 2.1.7 are vulnerable to arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue.

CNA Affected

[
  {
    "vendor": "actions",
    "product": "toolkit",
    "versions": [
      {
        "version": "< 2.1.7",
        "status": "affected"
      }
    ]
  }
]