[Security PoC] issue_comment触发的CI无权限校验+execSync命令注入(良性验证) - #458
Open
KDMZXY wants to merge 1 commit into
Open
Conversation
Author
|
build_prs |
|
|
|
Job is started, see https://github.com/vivoblueos/kernel/actions/runs/32845309151. |
|
❌ Job failed. Failed jobs: check_license (failure), build_and_check_boards (failure), see https://github.com/vivoblueos/kernel/actions/runs/32845309151. |
|
❌ Job failed. Failed jobs: check_license (failure), build_and_check_boards (cancelled), see https://github.com/vivoblueos/kernel/actions/runs/32845309151. |
wangchen-vivo
added a commit
to wangchen-vivo/kernel
that referenced
this pull request
Aug 26, 2026
Contributor
|
Thanks for the detailed PoC report! This has been fixed in #463. |
han-jiang277
pushed a commit
that referenced
this pull request
Aug 27, 2026
Fixes the command-injection RCE reported in [#458](#458), where attacker-controlled PR content was interpolated into `execSync` shell strings and could execute arbitrary commands in CI. ## Changes - **Command injection**: run format/license/check commands via `execFileSync` argument arrays instead of `execSync` string concatenation, so filenames/repo names are never interpreted by a shell (`poc$(id).rs` no longer expands). - **Fail-closed checks**: a format tool that fails to run (file missing, parse error, tool crash) now fails the job instead of being skipped and reported as "All modified files pass format check". - **Least privilege**: format, license, and build jobs run with `permissions: {}` and a placeholder `github-token: unused`, so injected code cannot obtain the job's `GITHUB_TOKEN`. Container GHCR login credentials and `packages: read` were removed because the image is public. - **Tokenless sync**: the old `setup` job is split into `resolve_prs`, which keeps a token to comment and resolve PRs, and `apply_prs`, which runs repo init, sync, merge, and upload without one. This way `repo sync` has no `GITHUB_TOKEN`, so a `<repo-hooks>` hook injected via an attacker-controlled manifests PR cannot execute untrusted code. - **Input validation**: `build_prs` links must belong to this org; PR metadata is passed to shell steps via `env` rather than `${{ }}` interpolation into `run:`, so a value containing shell metacharacters is treated as data and never evaluated as commands. - **Resource limits**: `concurrency` is grouped per PR, so a new `build_prs` comment cancels the in-progress run instead of launching another set of matrix build jobs. --------- Co-authored-by: wangchen-vivo <wangchen-vivo@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
安全研究PoC声明(vivo SRC漏洞验证)
漏洞: cross_repos_build.yml由 issue_comment 触发,仅检查评论含'build_prs'、无评论者身份/组织权限校验——任何GitHub用户在任意PR评论即可触发特权构建流水线(merge任意fork-PR代码+在携带GITHUB_TOKEN的容器内执行)。
本PR载荷严格良性: 仅一个文件
poc$(id).rs(内容为注释)。文件名中的 $(id) 用于验证 Check-format 作业 execSync 命令注入(双引号内命令替换)——若漏洞存在,格式检查错误信息将包含 id 命令的执行结果(回帖于此PR)。无数据访问/无网络外带/无secrets读取。验证后将关闭PR并删除fork分支。
报告已提交 vivo SRC (vivosrc.vulbox.com)。