CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

High 8.8 Published 24 Apr 2023 Updated 12 Feb 2025

Attackers can execute arbitrary commands in the CI workflow via untrusted input, requiring repository write access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-30628?

CVE-2023-30628 is a high-severity command injection vulnerability in kiwitcms Kiwi, published on 24 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.

Weakness: CWE-78

Which versions are affected by CVE-2023-30628?

1 open source package ship an affected version, including kiwitcms. It affects 1 product.

Package	Affected	Fixed in
`kiwitcms` PyPI	All versions	`12.3`

Products include Kiwitcms Kiwi Tcms.

How do I fix CVE-2023-30628?

Upgrade kiwitcms to 12.3 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-30628 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30628 exists.

Sources

Also known as GHSA-cw6r-6ccx-5hwx, PYSEC-2023-273.