RCE in Actions Toolkit
CVE-2020-15228
In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modified without the intention of the workflow or action author. The runner will release an update that disables the `set-env` and `add-path` workflow commands in the near future. For now, users should upgrade to `@actions/core v1.2.6` or later, and replace any instance of the `set-env` or `add-path` commands in their workflows with the new Environment File Syntax. Workflows and actions using the old commands or older versions of the toolkit will start to warn, then error out during workflow execution.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Actions Toolkit — versions < 1.2.6
- Toolkit Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w (Third Party Advisory)
- packetstormsecurity.com/files/159794/GitHub-Widespread-Injection.html (Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15228?
- CVE-2020-15228 is a low-severity vulnerability in Actions Toolkit, classified under Improper Input Validation. CVSS score: 3.5/10. Published 2020-10-01.
- How severe is CVE-2020-15228?
- Low severity. CVSS v3 base score is 3.5 out of 10.
- Is CVE-2020-15228 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.