Vulnerability in check-spelling/check-spelling (CVE-2021-32724)
Summary
Vulnerability in check-spelling/check-spelling (CVE-2021-32724). Successful exploitation can lead to full system takeover. Exploitable via pull_request_target. Mitigation: upgrade to 0.0.19 or later.
Original description
The description as published by the source.
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed. With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: Disable the workflow until you've fixed all branches or Set repository to Allow specific actions. check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository Workflow permissions to Read repository contents permission. Workflows using check-spelling/check-spelling@main will get the fix automatically. Workflows usin…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-32724 has been found in check-spelling/check-spelling.
Attackers can target a specific entry point like pull_request_target over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: upgrade check-spelling/check-spelling to 0.0.19 or later.
If unsure, ask your IT team or search "check-spelling/check-spelling CVE-2021-32724" on the vendor's site.
CVE-2021-32724 (check-spelling/check-spelling) — CWE-532
Attack vector: remote (network-reachable) / no user interaction
Attack surface: pull_request_target / schedule / GITHUB_TOKEN
Patched: 0.0.19 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-532) exists in check-spelling/check-spelling. Attackers reach the vulnerable code path via pull_request_target.
Check the vendor advisory for the affected versions of check-spelling/check-spelling. Attack surface: pull_request_target / schedule / GITHUB_TOKEN.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to 0.0.19.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'check-spelling/check-spelling' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'check-spelling/check-spelling' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
check-spelling/check-spellingを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade check-spelling/check-spelling to 0.0.19ステージング環境で 0.0.19 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web github.com