CVE-2024-48908: lychee-action vulnerable to arbitrary code injection in composite action
Summary
There is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml.
Details
The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action.
PoC
yaml - uses: lycheeverse/lychee@v2 with: lycheeVersion: $(printenv >> $GITHUBSTEPSUMMARY && echo "v0.16.1")
The previous example will just print all the environment variables to the summary of the workflow, but an attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.
Impact
Low
Other sources
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
actions/lycheeverse/lychee-actionto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
lycheeverse/lycheeto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48908?
CVE-2024-48908 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-48908?
To remediate CVE-2024-48908, update the 'lychee-action' to version 2.0.2 or later.
What software is affected by CVE-2024-48908?
CVE-2024-48908 affects the 'lychee-action' GitHub Action prior to version 2.0.2.
What type of vulnerability is CVE-2024-48908?
CVE-2024-48908 is an arbitrary code injection vulnerability.
How can CVE-2024-48908 be exploited?
CVE-2024-48908 can be exploited by manipulating the 'inputs.lycheeVersion' variable to execute arbitrary code in the action's context.