CVE-2023-30623
📋 TL;DR
CVE-2023-30623 is a command injection vulnerability in the embano1/wip GitHub Action that allows attackers to execute arbitrary code on GitHub runners by submitting malicious pull request titles. This affects any GitHub repository using vulnerable versions of this action, potentially exposing CI/CD secrets and repository access. Attackers can trigger this without authentication by creating pull requests.
💻 Affected Systems
- embano1/wip GitHub Action
📦 What is this software?
Wip by Wip Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of GitHub runners, exfiltration of all CI/CD secrets (including repository tokens, API keys, credentials), unauthorized code execution, and potential lateral movement to connected systems.
Likely Case
Exfiltration of repository secrets and CI/CD pipeline credentials, unauthorized code execution in GitHub runners, potential supply chain attacks through compromised builds.
If Mitigated
Limited impact with proper input validation and runner isolation; potential denial of service if action fails but no code execution.
🎯 Exploit Status
Exploitation is straightforward: create a pull request with malicious title containing shell commands; GitHub advisory includes proof of concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2
Vendor Advisory: https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp
Restart Required: No
Instructions:
1. Update GitHub workflow files to use `embano1/wip@v2` or later. 2. Replace any references to `embano1/wip@v1` or `embano1/wip@main`. 3. Commit and push changes to repository. 4. Verify workflows run without errors.
🔧 Temporary Workarounds
Disable vulnerable action
allTemporarily disable or remove the embano1/wip action from GitHub workflows
# Edit .github/workflows/*.yml files and remove or comment out embano1/wip action steps
Input validation workaround
linuxAdd manual input validation for pull request titles before passing to action
# In workflow YAML, add a step to sanitize inputs:
- name: Validate PR title
run: |
if [[ "${{ github.event.pull_request.title }}" =~ [\;\|\&\$\`] ]]; then
echo "Invalid characters in PR title"
exit 1
fi
🧯 If You Can't Patch
- Disable pull request triggers for workflows using embano1/wip action
- Implement strict branch protection rules requiring maintainer approval for all pull requests
🔍 How to Verify
Check if Vulnerable:
Check GitHub workflow YAML files for references to embano1/wip action without version 2 or later specificationCheck Version:
grep -r "embano1/wip" .github/workflows/Verify Fix Applied:
Verify workflow files specify `embano1/wip@v2` or later; test with a safe pull request to confirm action works without errors📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands in GitHub Actions logs
- Unexpected process execution in runner logs
- Failed workflow runs due to command injection errors
Network Indicators:
- Unexpected outbound connections from GitHub runners during PR processing
- Data exfiltration patterns from CI/CD environment
SIEM Query:
source="github-actions" AND ("command injection" OR "unexpected command" OR "malicious title")🔗 References
- https://github.com/embano1/wip/commit/c25450f77ed02c20d00b76ee3b33ff43838739a2
- https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/embano1/wip/commit/c25450f77ed02c20d00b76ee3b33ff43838739a2
- https://github.com/embano1/wip/security/advisories/GHSA-rg3q-prf8-qxmp
- https://securitylab.github.com/research/github-actions-untrusted-input/
