Command Injection in Cocos Engine workflow

Vulnerability

CVE-2023-26493 is a command injection vulnerability in Cocos Engine's GitHub Actions workflow web-interface-check.yml. The workflow was triggered on pull_request_target events and used the user-controllable field ${{ github.head_ref }} (the name of the fork's branch) in a git command without sanitization. This affected the Cocos Engine repository up to version 3.7.0 [1].

Exploitation

An attacker forks the cocos/cocos-engine repository, creates a branch with a malicious name (e.g., develop;echo${IFS}"hello";#), and opens a pull request to the base repository. The workflow runs, executing the injected command in the context of the GitHub Runner with full write access to the repository token, allowing arbitrary command execution [1].

Impact

Successful exploitation gives the attacker control over the GitHub Runner, enabling theft of secrets like GITHUB_TOKEN and unauthorized modification of the repository contents [1].

Mitigation

The vulnerable workflow was disabled on 2023-02-17 and removed from the repository on 2023-02-21 via commit 6d06aefa2684e20da79e7ceaf41f728c1a8d7a41 [2][3]. No action is required from users, as the workflow has been deleted [1].