CVE-2023-27581
📋 TL;DR
CVE-2023-27581 is a command injection vulnerability in github-slug-action that allows attackers to execute arbitrary code on GitHub runners by manipulating pull request branch names. Any GitHub user can exploit this against workflows using vulnerable versions of the action, potentially compromising CI/CD pipelines and stealing secrets. This affects all users of github-slug-action versions 4.0.0 through 4.4.0.
💻 Affected Systems
- github-slug-action
📦 What is this software?
Github Slug Action by Github Slug Action Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of GitHub runners, exfiltration of all CI/CD secrets, unauthorized code execution in production environments, and lateral movement to connected systems.
Likely Case
Attackers execute arbitrary commands on runners, steal repository secrets, modify build artifacts, and potentially pivot to other systems in the CI/CD pipeline.
If Mitigated
With proper input validation and runner isolation, impact is limited to the specific runner instance, though secrets exposed to that runner would still be compromised.
🎯 Exploit Status
Exploitation requires GitHub account access to create pull requests, but any GitHub user can target public repositories. The attack is simple and well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.1
Vendor Advisory: https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w
Restart Required: No
Instructions:
1. Update your GitHub workflow YAML files to use github-slug-action@v4.4.1 or later. 2. Replace any references to older versions with: uses: rlespinasse/github-slug-action@v4.4.1. 3. Test your workflows to ensure compatibility.
🔧 Temporary Workarounds
Temporarily disable github-slug-action
allRemove or comment out github-slug-action usage in workflows until patched
# Comment out: uses: rlespinasse/github-slug-action@v4
🧯 If You Can't Patch
- Disable github-slug-action on pull request workflows by adding condition: if: github.event_name != 'pull_request'
- Implement strict branch naming policies to prevent malicious branch names
🔍 How to Verify
Check if Vulnerable:
Inspect your .github/workflows/*.yml files for lines containing: uses: rlespinasse/github-slug-action@ and check if version is between 4.0.0 and 4.4.0Check Version:
grep -r "rlespinasse/github-slug-action" .github/workflows/Verify Fix Applied:
Confirm workflow files now specify: uses: rlespinasse/github-slug-action@v4.4.1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in GitHub Actions logs
- Suspicious branch names containing shell metacharacters
- Unexpected environment variable modifications
Network Indicators:
- Unexpected outbound connections from GitHub runners during build process
SIEM Query:
source="github-actions" AND "github-slug-action" AND (branch_name CONTAINS "$" OR branch_name CONTAINS "`" OR branch_name CONTAINS "|")🔗 References
- https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94
- https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1
- https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94
- https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1
- https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w
- https://securitylab.github.com/research/github-actions-untrusted-input/
