Command Injection in Cocos Engine workflow
Résumé
Command Injection in Cocos Engine workflow
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the web-interface-check.yml was subject to command injection. The web-interface-check.yml was triggered when a pull request was opened or updated and contained the user controllable field (${{ github.head_ref }} – the name of the fork’s branch). This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch github.com
- web github.com