CVE-2022-35954 : Exploit Details and Defense Strategies

GitHub Actions Toolkit has been found to have a delimiter injection vulnerability in the

@actions/core exportVariable

function, affecting versions up to 1.9.0. Upgrading to

@actions/core v1.9.1

is recommended to mitigate this issue.

Understanding CVE-2022-35954

This CVE highlights a vulnerability in the GitHub Actions Toolkit that could allow attackers to manipulate arbitrary variables through a delimiter injection technique.

What is CVE-2022-35954?

The vulnerability arises from the improper use of delimiters in the

core.exportVariable

function, enabling attackers to modify environment variables unintentionally when untrusted values are written to the

GITHUB_ENV

file.

The Impact of CVE-2022-35954

The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 5. Attack complexity is low, and exploitation via network vectors requires minimal privileges. While confidentiality impact is none, integrity impact is low.

Technical Details of CVE-2022-35954

This section provides more insights into the vulnerability, affected systems, and exploitation mechanisms.

Vulnerability Description

The vulnerability allows attackers to exploit delimiters in the

core.exportVariable

function, leading to unauthorized modification of environment variables.

Affected Systems and Versions

Versions of the

@actions/core

toolkit up to v1.9.0 are affected by this vulnerability.

Exploitation Mechanism

Attackers can leverage the delimiter injection to assign values to unintended variables, potentially compromising the integrity of workflows.

Mitigation and Prevention

To safeguard your systems against CVE-2022-35954, follow these mitigation strategies:

Immediate Steps to Take

Upgrade to

@actions/core v1.9.1

to patch the vulnerability and prevent delimiter injections. Alternatively, sanitize user inputs to exclude the delimiter

_GitHubActionsFileCommandDelimeter_

before invoking

core.exportVariable

.

Long-Term Security Practices

Educate developers on secure coding practices and regularly review workflows for potentially vulnerable code patterns.

Patching and Updates

Stay informed about security advisories and apply patches promptly to address known vulnerabilities in the GitHub Actions Toolkit.