CVE-2024-42471: Arbitrary File Write via artifact extraction in actions/artifact
Impact
Versions of actions/artifact before 2.1.7 are vulnerable to arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted artifact that contains path traversal filenames.
Patches
Upgrade to version 2.1.7 or higher.
References
- https://snyk.io/research/zip-slip-vulnerability - https://github.com/actions/toolkit/pull/1724
CVE
CVE-2024-42471
Credits
Justin Taft from Google
Other sources
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of actions/artifact on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42471?
CVE-2024-42471 is regarded as a moderate severity vulnerability due to potential arbitrary file write issues.
How do I fix CVE-2024-42471?
To fix CVE-2024-42471, upgrade the @actions/artifact package to version 2.1.7 or later.
What components are affected by CVE-2024-42471?
CVE-2024-42471 affects versions of the @actions/artifact package before 2.1.7.
What types of attacks can exploit CVE-2024-42471?
CVE-2024-42471 can be exploited through crafted artifacts that utilize path traversal filenames.
Is CVE-2024-42471 related to GitHub Actions security?
Yes, CVE-2024-42471 falls under vulnerabilities associated with GitHub Actions and its toolkit.