CVE-2023-31128
📋 TL;DR
This CVE describes a command injection vulnerability in NextCloud Cookbook's GitHub Actions workflow. Attackers with write access to the repository can inject malicious commands by manipulating the github.head_ref field, potentially compromising the repository's CI/CD pipeline. Only the main repository and its forks are affected - NextCloud server users are not at risk.
💻 Affected Systems
- NextCloud Cookbook
📦 What is this software?
Cookbook by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the repository, allowing attackers to inject malicious code, steal secrets, or pivot to other systems in the CI/CD environment.
Likely Case
Unauthorized code execution in GitHub Actions runners, potentially leading to repository manipulation, secret exfiltration, or supply chain attacks.
If Mitigated
No impact if the repository has been updated to the fixed commits or if proper input validation is implemented.
🎯 Exploit Status
Exploit requires write access to the repository. The advisory includes specific payload examples for command injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commits a46d9855 (master) and 489bb744 (main-0.9.x)
Vendor Advisory: https://github.com/nextcloud/cookbook/security/advisories/GHSA-c5pc-mf2f-xq8h
Restart Required: No
Instructions:
1. Update your fork to include commit a46d9855 (master branch) or 489bb744 (main-0.9.x branch). 2. Verify the .github/workflows/pull-checks.yml file no longer uses untrusted github.head_ref input directly in shell commands.
🔧 Temporary Workarounds
Disable vulnerable workflow
allTemporarily disable the pull-checks.yml workflow in GitHub repository settings
Manual input validation
allAdd input validation to sanitize github.head_ref before use in shell commands
🧯 If You Can't Patch
- Review repository access controls and limit write permissions to trusted contributors only
- Monitor GitHub Actions logs for suspicious command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check if your .github/workflows/pull-checks.yml file contains direct usage of ${{ github.head_ref }} in shell commands without proper sanitizationCheck Version:
git log --oneline | grep -E 'a46d9855|489bb744'Verify Fix Applied:
Verify the workflow file uses proper input validation or references the fixed commits in the repository history📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in GitHub Actions logs
- Suspicious shell commands containing echo${IFS} or similar injection patterns
Network Indicators:
- Unexpected outbound connections from GitHub Actions runners
SIEM Query:
source="github-actions" AND (command="echo${IFS}" OR command="zzz")🔗 References
- https://github.com/nextcloud/cookbook/blob/a14d6ffc4d45e1447556f68606129dfd6c1505cf/.github/workflows/pull-checks.yml#L67
- https://github.com/nextcloud/cookbook/commit/489bb744
- https://github.com/nextcloud/cookbook/commit/a46d98559e2c64292da9ffb06138cccc2e50ae1b
- https://github.com/nextcloud/cookbook/security/advisories/GHSA-c5pc-mf2f-xq8h
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/nextcloud/cookbook/blob/a14d6ffc4d45e1447556f68606129dfd6c1505cf/.github/workflows/pull-checks.yml#L67
- https://github.com/nextcloud/cookbook/commit/489bb744
- https://github.com/nextcloud/cookbook/commit/a46d98559e2c64292da9ffb06138cccc2e50ae1b
- https://github.com/nextcloud/cookbook/security/advisories/GHSA-c5pc-mf2f-xq8h
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/nextcloud/cookbook/security/advisories/GHSA-c5pc-mf2f-xq8h
