CVE-2023-52137 GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames
Attackers can execute arbitrary code and steal secrets via command injection in changed filenames within the verify-changed-files GitHub Action.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52137?
CVE-2023-52137 is a high-severity command injection vulnerability in tj-actions verify-changed-files, published on 29 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`.
This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.
Which versions are affected by CVE-2023-52137?
1 open source package ship an affected version, including tj-actions/verify-changed-files. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tj-actions/verify-changed-files GitHub Actions | All versions | 17 |
Products include Tj-Actions Verify-Changed-Files.
How do I fix CVE-2023-52137?
Upgrade tj-actions/verify-changed-files to 17 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-52137 being exploited?
There is no known exploitation of CVE-2023-52137 in the wild and no public exploit code.
Sources
Also known as GHSA-ghm2-rq8q-wrhc.