CVE-2024-41127: GHSL-2024-167: Poisoned Pipeline Execution through Code Injection in Monkeytype - CVE-2024-41127
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./prnum/prnum.txt artifact to the steps.prnumreader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41127?
CVE-2024-41127 has been assessed as a high severity vulnerability due to the potential for code injection and unauthorized access.
How do I fix CVE-2024-41127?
To mitigate CVE-2024-41127, update to a version of Monkeytype that is 24.30.0 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2024-41127?
CVE-2024-41127 is a Code Injection vulnerability that allows for Poisoned Pipeline Execution.
Can CVE-2024-41127 be exploited remotely?
Yes, CVE-2024-41127 can be exploited remotely by attackers through malicious pull requests.
Which versions of Monkeytype are affected by CVE-2024-41127?
Monkeytype versions prior to 24.30.0 are affected by CVE-2024-41127.