GHSA-hr4h-4c45-v4q4: compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
Impact
0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. --format json and --format sarif output never passed through that fix, so ##[ inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on ##[ in the middle of a line, so the JSON layout does not prevent it.
A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.
Affected setups print JSON or SARIF output to a CI log from the compose-lint package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.
Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.
Docker image. composelint/compose-lint tag 0.31.0 and the matching minor tag are affected, as was latest while it pointed to 0.31.0.
Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.
Patches
Fixed in 0.32.0. JSON and SARIF on stdout escape ##[ inside strings as \u005b, which decodes to the same data.
Workarounds
- Upgrade to 0.32.0 or later. - Write --format json and --format sarif output to a file rather than the log. - On GitHub Actions, use the tmatens/compose-lint Action, or bracket the compose-lint step with ::stop-commands::<random token> and ::<token>::, as the Action does.
Reproduction
On compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named a##[warning]X, linted with --format json or --format sarif to stdout, creates annotations. The same file linted with the text report creates none. The composelint/compose-lint:0.31.0 image produces byte-identical output to the package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/compose-lintto a version that resolves this vulnerability.Fixed in 0.32.0 - Upgrade
Upgrade
composelint/compose-lintto a version that resolves this vulnerability.Fixed in 0.32.0 - Configuration
Write --format json and --format sarif output to a file rather than printing it to the CI log.
compose-lint JSON/SARIF output destination = file - Compensating control
On GitHub Actions, use the tmatens/compose-lint Action, or bracket the compose-lint step with ::stop-commands::<random token> and ::<token>::.
Event History
Frequently Asked Questions
Which CI configurations are exposed to this issue?
Affected setups run compose-lint on unreviewed Compose files and print its JSON or SARIF output to stdout in a CI log. This includes use through the compose-lint package, pre-commit hook, or Docker image; the GitHub Action is not affected because it disables command processing around each run.
What must an attacker control to exploit it?
An attacker needs to submit a Compose file that CI scans before review and place ##[ in a service name or another value included in compose-lint output. The CI runner can then interpret that text as workflow commands when JSON or SARIF is printed to stdout.
What can happen if exploitation succeeds?
An attacker can create annotations, fold or hide portions of the job log, or issue other commands accepted by the runner. The compose-lint pass/fail result is not changed.
What mitigation is available if updating is not immediately possible?
Write JSON or SARIF output to a file rather than printing it to stdout. SARIF output used for upload is not affected because it is written to a file.