{"id":"GHSA-5xr6-xhww-33m4","summary":"Artifact poisoning vulnerability in action-download-artifact v5 and earlier","details":"### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).\n","modified":"2024-11-25T15:26:43Z","published":"2024-11-25T15:26:43Z","database_specific":{"github_reviewed_at":"2024-11-25T15:26:43Z","nvd_published_at":null,"cwe_ids":["CWE-349"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4"},{"type":"WEB","url":"https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11"},{"type":"PACKAGE","url":"https://github.com/dawidd6/action-download-artifact"},{"type":"WEB","url":"https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust"}],"affected":[{"package":{"name":"dawidd6/action-download-artifact","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-5xr6-xhww-33m4/GHSA-5xr6-xhww-33m4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}