9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.9%
For a repository with the check-spelling action enabled that triggers on pull_request_target
(or schedule
), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN
to be exposed.
With the GITHUB_TOKEN
, it’s possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository.
You can either:
or
Allow actions created by GitHub
Allow Marketplace actions by verified creators
check-spelling isn’t a verified creator and it certainly won’t be anytime soon. You could then explicitly add other actions that your repository uses.
or
Read repository contents permission
.Workflows using check-spelling/check-spelling@main
were fixed automatically with the release of v0.0.19.
Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version.
In the simple case, you have few enough open branches that you can do the following on all branches.
check-spelling/check-spelling@main
, orcheck-spelling/[email protected]
, oron: push
If you have too many open branches to feasibly fix all of them as per the above, you can instead do the following:
check-spelling
to be active.check-spelling
to be active, rename the workflow file (e.g. to spelling2.yml
)spelling.yml
).spelling.yml
).This should prevent the vulnerable workflow from executing on any branches that you have not applied the proper solution to.
The reason for creating the dummy file (Step 3) before disabling the workflow (Step 4) is that, in our testing, GitHub may un-disable a workflow if it does not exist on your default branch.
Example dummy workflow file (For step 3):
# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
name: Workflow should not run!
on:
push:
branches: ''
jobs:
placeholder:
name: Should be disabled
runs-on: ubuntu-latest
if: false
steps:
- name: Task
run: |
echo 'Running this task would be bad'
exit 1
You should also include a comment in the new workflow to remind people not to resurrect the old name, for example:
# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
Finally, you should consider sending a Pull Request to an open branch in which you have not performed the proper solution to verify that the old version of check-spelling
does not execute.
Perform this change to your impacted workflow file (typically .github/workflows/spelling.yml
):
@@ -24 +24 @@
- - uses: check-spelling/[email protected]
+ - uses: check-spelling/[email protected]
As noted above, if you have many branches, you should additionally rename the workflow and include a comment to remind people not to use the old workflow file name:
# spelling.yml is blocked per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target
, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.
pull_request_target
attacks, see GitHub Security Lab: Keeping your GitHub Actions and workflows secure: Preventing pwn requestsThanks to @justinsteven for reporting as well as in helping validate the fix.
For questions or comments about this advisory:
github.com/check-spelling/check-spelling
github.com/check-spelling/check-spelling/commit/436362fc6b588d9d561cbdb575260ca593c8dc56
github.com/check-spelling/check-spelling/releases/tag/v0.0.19
github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
nvd.nist.gov/vuln/detail/CVE-2021-32724
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.9%