Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-54132

CVE-2024-54132: Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability

6.3

CVSS Score
4.0

Basic Information

CVE ID
CVE-2024-54132
GHSA ID
GHSA-2m9h-r57g-45pj
EPSS Score
0.26678%
CWE
CWE-22
Published
12/4/2024
Updated
12/4/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/cli/cli/v2go< 2.63.12.63.1
github.com/cli/cligo<= 1.14.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from two key issues: 1) In download.go, the runDownload() function combined user-controlled artifact names with target directories without sufficient validation, particularly dangerous when artifact names contained '..'. 2) The original filepathDescendsFrom() function in zip.go had inadequate path traversal detection. The commit added critical checks in both locations - a new path validation guard clause in runDownload() and improved relative path calculation in filepathDescendsFrom(). The test cases in download_test.go specifically demonstrate handling of '..' artifact names, confirming these were the vulnerable points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry * s**urity vuln*r**ility **s ***n i**nti*i** in *it*u* *LI t**t *oul* *r**t* or ov*rwrit* *il*s in unint*n*** *ir**tori*s w**n us*rs *ownlo** * m*li*ious *it*u* **tions work*low *rti***t t*rou** `** run *ownlo**`. ### **t*ils T*is vul

Reasoning

T** vuln*r**ility st*mm** *rom two k*y issu*s: *) In `*ownlo**.*o`, t** `run*ownlo**()` *un*tion *om*in** us*r-*ontroll** *rti***t n*m*s wit* t*r**t *ir**tori*s wit*out su**i*i*nt v*li**tion, p*rti*ul*rly **n**rous w**n *rti***t n*m*s *ont*in** '..'.