GitHub Advisory DatabaseGHSA-CXWW-7G56-2VH6@actions/download-artifact has an Arbitrary File Write via artifact extraction
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
21.9%
Impact
Versions of actions/download-artifact before 4.1.7 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.
Patches
Upgrade to version 4.1.7 or higher. Alternatively use ‘v4’ tag which points to the latest and secure version.
References
- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/actions/download-artifact/releases/tag/v4.1.7
CVE
CVE-2024-42471
Credits
Justin Taft from Google
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| actions | download-artifact | * | cpe:2.3:a:actions:download-artifact:*:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
21.9%