by Kastro
Paper/Archive/CVE-2024-21623

CVE-2024-21623

mehah otclient — Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.8.688 × 2013.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.

Affected

ProductAffectedFixed inSource
otclient< db560de0b56476c87a2f967466407939196dd254–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589refgithub.com/mehah/otclient/commit/db560de0b56476c87a2f967466407939196dd254refgithub.com/mehah/otclient/blob/72744edc3b9913b920e0fd12e929604f682fda75/.github/workflows/analysis-sonarcloud.yml#L91-L104refsecuritylab.github.com/research/github-actions-preventing-pwn-requestsrefsecuritylab.github.com/research/github-actions-untrusted-input