Google's Project Zero discloses 'high' severity security flaw in GitHub

guest · Nov 3, 2020

Google discloses 'high' severity security flaw in GitHub
November 3, 2020
https://www.neowin.net/news/google-discloses-high-severity-security-flaw-in-github

Google's Project Zero team is well-known for discovering vulnerabilities and bugs in Google's own software as well as that developed by other companies. Its methodology involves identifying security flaws in software and privately reporting them to vendors, giving them 90 days to fix them before public disclosure.

The vulnerability has been classified as a "high" severity issue by Google Project Zero. We'll spare you the nitty-gritty technical details - and you're free to view them in detail here if you want - but the meat of the matter is that workflow commands in GitHub Actions are extremely vulnerable to injection attacks. For those unaware, workflow commands act as a communication channel between executed actions and the Action Runner.
Click to expand...

In his original post, Wilhelm went on to say that he's unsure how to fix the issue as the way workflow commands are implemented is "fundamentally insecure".

Following the discovery of the security flaw on July 21, the Project Zero team naturally reached out to GitHub with information about the vulnerability, giving them the standard 90 days to resolve it - which would expire on October 18.
There was officially radio silence from GitHub since October 28. On November 1, GitHub requested the Project Zero team to allocate an additional 48 hours.

[...] the flaw has been made public by the security team today with a proof-of-concept code made available as well.
Click to expand...

guest · Nov 21, 2020

GitHub finally fixes 'high' severity security flaw reported by Google Project Zero
November 21, 2020
https://www.neowin.net/news/github-...security-flaw-reported-by-google-project-zero

At the start of November, Google publicly disclosed a "high" severity security issue in GitHub following the latter's inability to fix it in 104 days - more than the standard time frame. However, GitHub users will now be pleased to know that the security hole has finally been filled.

The security flaw in question was that workflow commands - which act as a communication channel between executed actions and the Action Runner - in GitHub Actions are extremely vulnerable to injection attacks. Google Project Zero's Felix Wilhelm, who originally reported the security flaw, stated that the way workflow commands are implemented is "fundamentally insecure".
Click to expand...

Google publicly disclosed the issue on November 2 following GitHub's failure to fix the issue in the allotted 104 days.
Apparently, this has put some pressure on the company as the vulnerability has now been patched. The patch notes indicate that the fix is in line with Wilhelm's proposed short-term solution:

Disabled add-path and set-env runner commands (#779)

Updated dotnet install scripts (#779)

Click to expand...

Log in or Sign up

Google's Project Zero discloses 'high' severity security flaw in GitHub

guest Guest

guest Guest

Log in or Sign up

Google's Project Zero discloses 'high' severity security flaw in GitHub

guest Guest

guest Guest

Useful Searches