SB2024121908 - Arbitrary file overwrite in GitHub CLI

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2024-54132)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences within the "gh run download" command when downloading GitHub Actions workflow artifact. A remote attacker can trick the victim into downloading a specially crafted GitHub Actions workflow artifact and overwrite arbitrary files on the system, leading to potential remote code execution.

Remediation

Install update from vendor's website.

References

• https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932
• https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj