Lucene search

GitHub_MVULNRICHMENT:CVE-2024-42471

HistorySep 02, 2024 - 4:13 p.m.

CVE-2024-42471 Arbitrary File Write via artifact extraction in actions/artifact

2024-09-0216:13:50

CWE-22

GitHub_M

github.com

cve-2024-42471

arbitrary file write

github toolkit

github actions

version 2.1.7 or higher

path traversal filenames

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

21.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of actions/artifact before 2.1.7 are vulnerable to arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.7 or higher. There are no known workarounds for this issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:actions\\/artifact\\/:github_toolkit:*:*:*:*:*:*:*:*"
    ],
    "vendor": "actions\\/artifact\\/",
    "product": "github_toolkit",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.1.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/actions/toolkit/pull/1724

github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3

snyk.io/research/zip-slip-vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

21.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-42471