CVE-2023-26493
Command Injection in Cocos Engine workflow
Summary
Command Injection in Cocos Engine workflow
Original description
The description as published by the source.
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the web-interface-check.yml was subject to command injection. The web-interface-check.yml was triggered when a pull request was opened or updated and contained the user controllable field (${{ github.head_ref }} – the name of the fork’s branch). This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch github.com
- web github.com