CVE-2023-22726

{"id": "CVE-2023-22726", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-01-20T22:15:10.533", "references": [{"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/issues/1553", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nektos/act/issues/1553", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://securitylab.github.com/advisories/GHSL-2023-004_act/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually."}, {"lang": "es", "value": "act es un proyecto que permite la ejecuci\u00f3n local de acciones de github. El servidor de artefactos que almacena artefactos de las ejecuciones de Github Action no sanitiza las entradas de ruta. Esto permite a un atacante descargar y sobrescribir archivos arbitrarios en el host desde una Github Action. Este problema puede provocar una escalada de privilegios. El endpoint /upload es vulnerable a path traversal, ya que la ruta del archivo est\u00e1 controlada por el usuario y, en \u00faltima instancia, fluye hacia os.Mkdir y os.Open. El endpoint /artifact es vulnerable a path traversal, ya que la ruta es variable y est\u00e1 controlada por el usuario y, en \u00faltima instancia, el servidor devuelve el archivo especificado. Esto se ha solucionado en la versi\u00f3n 0.2.40. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden, durante la implementaci\u00f3n de Open y OpenAtEnd para FS, asegurarse de usar ValidPath() para verificar el path traversal o limpiar las rutas proporcionadas por el usuario manualmente."}], "lastModified": "2024-11-21T07:45:18.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:act_project:act:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "35CF3411-A8C4-4D5C-A1E2-33E19D14DFDC", "versionEndExcluding": "0.2.40"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}