SC-GHA-SCRIPT-INJECTION-2020

CI/CD · GitHub Actions · GitHub Actions workflows

Résumé

GitHub Security Lab documented (initial guidance August 20, 2020, updated since) a widespread GitHub Actions vulnerability class in which attacker-controlled event fields interpolated into run shell steps cause command execution. Because expressions in double-brace syntax are evaluated and substituted into the temporary shell script before the runner executes it, embedding an untrusted field such as github.event.issue.title or github.event.pull_request.head_ref directly in a run block lets the attacker break out of the intended command. An attacker who simply opens an issue or PR with a title containing a quote and a shell payload (for example a backtick command-substitution or a semicolon-curl sequence) executes arbitrary commands on the runner, reading environment variables and exfiltrating GITHUB_TOKEN and repository secrets to an external host. This is expression/script injection via untrusted github.event input, found across a large number of public-repo workflows. The fix is to never interpolate untrusted context into a shell; pass it through an intermediate quoted environment variable so it is treated as data, not script.

Comment l’éviter dans votre code

Never interpolate github.event.* directly into run shells; assign it to an env variable and reference it quoted.
Treat all github.event fields ending in title, body, ref, head_ref, name, label, message, or email as untrusted input.
Set GITHUB_TOKEN permissions to read-only by default and grant write scopes only on the specific jobs that need them.
Run static analysis (CodeQL, zizmor) on workflow files to catch expression-injection sinks before merge.
Move logic that handles untrusted input into a pinned action or script that takes arguments, not inline templated shell.

Références

Vulnérabilités liées

Tout Supply chain →