PYSEC-2023-273

Vulnerability from pysec - Published: 2023-04-24 22:15 - Updated: 2024-11-21 14:22
VLAI
Details

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the changelog.yml workflow is vulnerable to command injection attacks because of using an untrusted github.head_ref field. The github.head_ref value is an attacker-controlled value. Assigning the value to zzz";echo${IFS}"hello";# can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Impacted products
Name purl
kiwitcms pkg:pypi/kiwitcms
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms",
        "purl": "pkg:pypi/kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751"
            }
          ],
          "repo": "https://github.com/kiwitcms/enterprise",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "834c86dfd1b2492ccad7ebbfd6304bfec895fed2"
            }
          ],
          "repo": "https://github.com/kiwitcms/Kiwi",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0",
        "10.1",
        "10.2",
        "10.3",
        "10.3.999",
        "10.4",
        "10.5",
        "11.0",
        "11.1",
        "11.3",
        "11.4",
        "11.5",
        "11.6",
        "11.7",
        "12.0",
        "12.1",
        "12.2",
        "6.10",
        "6.11",
        "6.2.1",
        "6.3",
        "6.4",
        "6.5",
        "6.5.3",
        "6.6",
        "6.7",
        "6.8",
        "6.9",
        "7.0",
        "7.1",
        "7.2",
        "7.2.1",
        "7.3",
        "8.0",
        "8.1",
        "8.1.99",
        "8.2",
        "8.3",
        "8.4",
        "8.5",
        "8.6",
        "8.6.1",
        "8.7",
        "8.8",
        "8.9",
        "9.0",
        "9.999"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30628",
    "GHSA-cw6r-6ccx-5hwx"
  ],
  "details": "Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,\nthe `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz\";echo${IFS}\"hello\";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.",
  "id": "PYSEC-2023-273",
  "modified": "2024-11-21T14:22:53.063160+00:00",
  "published": "2023-04-24T22:15:00+00:00",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/kiwitcms/enterprise/commit/e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-cw6r-6ccx-5hwx"
    },
    {
      "type": "FIX",
      "url": "https://github.com/kiwitcms/Kiwi/commit/834c86dfd1b2492ccad7ebbfd6304bfec895fed2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/blob/37bfb87696093ce0393160e2725949185cc0651d/.github/workflows/changelog.yml#L18"
    },
    {
      "type": "EVIDENCE",
      "url": "https://securitylab.github.com/research/github-actions-untrusted-input/"
    },
    {
      "type": "WEB",
      "url": "https://securitylab.github.com/research/github-actions-untrusted-input/"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.