Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

CVE-2023-22381

What is CVE-2023-22381?

A code injection vulnerability allows an attacker with permission to control the environment variable values in GitHub Actions to potentially set arbitrary environment variables. This can lead to unauthorized actions or data leaks depending on the environment set up during CI/CD processes. All versions of GitHub Enterprise Server prior to 3.8.0 are affected, with fixes implemented in versions 3.4.15, 3.5.12, 3.6.8, and 3.7.5. This vulnerability was reported through the GitHub Bug Bounty program, emphasizing the importance of maintaining updated software to prevent exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References