CVE-2023-26493 – This CVE describes a command injection vulnerab... (How to Fix)

Q: What is the severity of CVE-2023-26493?

CVE-2023-26493 has a CVSS score of 8.1 (HIGH). This CVE describes a command injection vulnerability in Cocos Engine's GitHub Actions workflow that allowed attackers to execute arbitrary commands on GitHub Runners. The vulnerability affected users who forked the repository and opened pull requests, potentially allowing repository takeover and secret theft. The workflow has been removed, so no user action is required.

📋 TL;DR

This CVE describes a command injection vulnerability in Cocos Engine's GitHub Actions workflow that allowed attackers to execute arbitrary commands on GitHub Runners. The vulnerability affected users who forked the repository and opened pull requests, potentially allowing repository takeover and secret theft. The workflow has been removed, so no user action is required.

💻 Affected Systems

Products:

Cocos Engine

Versions: All versions using the vulnerable web-interface-check.yml workflow

Operating Systems: Any (GitHub Actions runners)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affected users who forked the repository and opened pull requests. The vulnerability was in GitHub Actions workflow configuration, not the engine code itself.

📦 What is this software?

Cocos Engine by Cocos

View all CVEs affecting Cocos Engine →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the GitHub repository including code modification, secret theft (GITHUB_TOKEN), and potential supply chain attacks through malicious commits.

🟠

Likely Case

Unauthorized command execution on GitHub Runners leading to repository manipulation and potential secret exfiltration.

🟢

If Mitigated

No impact as the vulnerable workflow has been removed from the repository.

🌐 Internet-Facing: HIGH - The vulnerability was exploitable via GitHub pull requests from public forks.

🏢 Internal Only: LOW - The vulnerability was specific to GitHub Actions workflows, not internal systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple command injection via pull request branch name.

Exploitation required creating a fork and opening a pull request. The vulnerability has been fixed by removing the workflow.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Workflow removed in commit 6d06aefa2684e20da79e7ceaf41f728c1a8d7a41

Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2023-027_Engine_for_Cocos_Creator/

Restart Required: No

Instructions:

1. Ensure your repository uses the latest version from the official Cocos Engine repository. 2. Verify the .github/workflows/web-interface-check.yml file has been removed. 3. If you copied this workflow to other repositories, remove it there as well.

🔧 Temporary Workarounds

Remove vulnerable workflow

all

Delete the web-interface-check.yml workflow file from your repository

rm .github/workflows/web-interface-check.yml

🧯 If You Can't Patch

Disable GitHub Actions for the repository temporarily
Review and audit all GitHub Actions workflows for similar command injection patterns

🔍 How to Verify

Check if Vulnerable:

Check if .github/workflows/web-interface-check.yml exists in your repository and contains the vulnerable pattern with ${{ github.head_ref }}

Check Version:

git log --oneline -n 5 .github/workflows/web-interface-check.yml

Verify Fix Applied:

Confirm the web-interface-check.yml file no longer exists in .github/workflows/ directory

📡 Detection & Monitoring

Log Indicators:

Unusual GitHub Actions workflow executions
Unexpected commands in workflow logs
Pull requests from unfamiliar forks triggering workflows

Network Indicators:

Unusual outbound connections from GitHub Actions runners

SIEM Query:

source="github-actions" AND (command_injection OR suspicious_command OR unauthorized_workflow)

📊 Metadata

CVE ID: CVE-2023-26493

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-74

Published: March 27, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-26493, you might also want to check these: