Summary
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
Affected Services
GitHub Actions
Remediation
Upgrade to @actions/core v1.9.1 or ensure user input does not contain the delimiter '_GitHubActionsFileCommandDelimeter_' before calling core.exportVariable.
Tracked CVEs
CVE-2022-35954
References
Contributed by https://github.com/sshayb
Entry Status
Finalized
Disclosure Date
-
Exploitablity Period
Until 2022/08/12
Known ITW Exploitation
-
Detection Methods
Review workflows and actions that write untrusted values to the GITHUB_ENV file. Check for potential manipulation of path or other environment variables.
Piercing Index Rating
-
Discovered by
Juho Nurminen
