CVE-2022-46179

Authentication bypass via GITHUB_ACTIONS environment variable

• CVSS 7.8
• CWE-639 Authorization Bypass Through User-Controlled Key
• Authentication, Authorization, and Session Management
• Remote

LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest commit (c658b4f3e57258acf5f6207a90c2f2169698ae22) by requiring the var to be set to true, causing a test script to run instead of being able to login. A potential workaround is to check for the GITHUB_ACTIONS environment variable and set it to "" (no quotes) to null the variable and force credential checks.

CVE

CVE-2022-46179

CWE

CWE-639 Authorization Bypass Through User-Controlled Key

CVSS base score

7.8

Published

2022-12-28

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update LiuOS to version 0.1.1 or higher.

import os

def check_authentication():
    github_actions = os.getenv('GITHUB_ACTIONS')
    if github_actions is None or github_actions.lower() == 'true':
        print("Skipping authentication checks.")
    else:
        print("Proceeding with authentication.")

check_authentication()

import os
import sys

def check_authentication():
    github_actions = os.getenv('GITHUB_ACTIONS', '').strip()
    if github_actions.lower() != 'true':
        print("Authentication checks required.")
        sys.exit(1)
    else:
        print("Running in GitHub Actions, skipping authentication.")

check_authentication()

@misc{vaitp:cve202246179,
  title        = {{Authentication bypass via GITHUB_ACTIONS environment variable}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-46179},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-46179/}}
}