Summary
A vulnerability in Azure API Management Developer Portal allows arbitrary code execution and secret exfiltration. The issue stems from a workflow that loads untrusted data from opened issues, potentially allowing attackers to inject malicious commands. This could lead to code execution in the runner, granting access to sensitive tokens and permissions.
Affected Services
API Management Developer Portal
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
Tue, Oct 22nd, 2024
Exploitablity Period
Until 2024/11/04
Known ITW Exploitation
-
Detection Methods
Monitor for suspicious activity in GitHub Actions workflows, especially those handling user-supplied data. Review and audit workflows for potential code injection vulnerabilities.
Piercing Index Rating
-
Discovered by
Alvaro Munoz, GitHub Security Lab
