fish-shop syntax-check up to 1.6.11 Workflow delimiter

Summaryinfo

A vulnerability was found in fish-shop syntax-check up to 1.6.11 and classified as problematic. Impacted is an unknown function of the component Workflow Handler. Executing a manipulation can lead to delimiter. This vulnerability is registered as CVE-2024-42482. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in fish-shop syntax-check up to 1.6.11 and classified as problematic. This vulnerability affects an unknown code of the component Workflow Handler. The manipulation with an unknown input leads to a delimiter vulnerability. The CWE definition for the vulnerability is CWE-140. The product does not neutralize or incorrectly neutralizes delimiters. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-42482 since 08/02/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.6.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• fish-shop

Name

• syntax-check

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11

Website

• Product: https://github.com/fish-shop/syntax-check/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion